CVE-2026-57309 Blind SQL Injection in Windu CMS
Remote unauthenticated attackers can perform blind SQL injection via HTTP headers in Windu CMS, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57309?
CVE-2026-57309 is a critical SQL injection vulnerability in JCD Windu CMS, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.
Weakness: CWE-89
Which versions are affected by CVE-2026-57309?
How do I fix CVE-2026-57309?
No fix has been published for CVE-2026-57309 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-57309 being exploited?
There is no known exploitation of CVE-2026-57309 in the wild and no public exploit code.
Sources
Also known as GHSA-m6xq-wg6p-prq3.