CVE-2026-57309: critical vulnerability in JCD Windu CMS
Blind SQL Injection in Windu CMS
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.5%
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
JCD · Windu CMSRelated CVEs — JCD Windu CMS
In the same product, most dangerous first.
CVE-2026-57311MEDIUMUnrestricted Upload of File with Dangerous Type in Windu CMSEPSS 0.6%CVE-2025-59111MEDIUMBroken Access Control in Windu CMSEPSS 0.3%CVE-2025-59113MEDIUMBruteforce Protection Bypass in Windu CMSEPSS 0.3%CVE-2026-57310MEDIUMWeak password hashing in Windu CMSEPSS 0.3%CVE-2025-59116MEDIUMUser enumeration in Windu CMSEPSS 0.3%CVE-2025-59117MEDIUMMultiple Stored XSS in Windu CMSEPSS 0.2%