CVE-2026-57310 Weak password hashing in Windu CMS

Medium 6.3 Published 20 Jul 2026 Updated 20 Jul 2026

Weak password hashing in Windu CMS allows attackers to decode user credentials if hashes are obtained.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-57310?

CVE-2026-57310 is a medium-severity vulnerability in JCD Windu CMS, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

Weakness: CWE-916

Which versions are affected by CVE-2026-57310?

How do I fix CVE-2026-57310?

No fix has been published for CVE-2026-57310 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-57310 being exploited?

There is no known exploitation of CVE-2026-57310 in the wild and no public exploit code.

Sources

Also known as GHSA-m7pv-37vf-wpvv.