CVE-2026-57309: fallo crítico en JCD Windu CMS
Blind SQL Injection in Windu CMS
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.5%
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
JCD · Windu CMSCVEs relacionadas — JCD Windu CMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-57311MEDIUMUnrestricted Upload of File with Dangerous Type in Windu CMSEPSS 0.6%CVE-2025-59111MEDIUMBroken Access Control in Windu CMSEPSS 0.3%CVE-2025-59113MEDIUMBruteforce Protection Bypass in Windu CMSEPSS 0.3%CVE-2026-57310MEDIUMWeak password hashing in Windu CMSEPSS 0.3%CVE-2025-59116MEDIUMUser enumeration in Windu CMSEPSS 0.3%CVE-2025-59117MEDIUMMultiple Stored XSS in Windu CMSEPSS 0.2%