CVE-2025-59113 Bruteforce Protection Bypass in Windu CMS

Medium 6.9 Published 18 Nov 2025 Updated 5 Dec 2025

Attackers can bypass brute-force protection in Windu CMS by resetting a client-side parameter, enabling unlimited login attempts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-59113?

CVE-2025-59113 is a medium-severity vulnerability in JCD Windu CMS, published on 18 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter.

Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.

Weakness: CWE-307

Which versions are affected by CVE-2025-59113?

It affects 1 product.

Products include Windu Windu Cms.

How do I fix CVE-2025-59113?

No fix has been published for CVE-2025-59113 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-59113 being exploited?

There is no known exploitation of CVE-2025-59113 in the wild and no public exploit code.

Sources

Also known as GHSA-2r78-2mm9-hw6h.