CVE-2025-59117

Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulnerability can be exploited by a privileged user and may target users with higher privileges. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://cert.pl/posts/2025/11/CVE-2025-59110	Third Party Advisory
https://windu.org	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:windu:windu_cms:4.1:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Windu CMS es vulnerable a múltiples vulnerabilidades de Cross-Site Scripting (XSS) Almacenado en el endpoint de edición de páginas windu/admin/content/pages/edit/. Esta vulnerabilidad puede ser explotada por un usuario privilegiado y puede tener como objetivo a usuarios con privilegios superiores. El proveedor fue notificado con antelación sobre esta vulnerabilidad, pero no respondió con los detalles de la vulnerabilidad o el rango de versiones vulnerables. Solo la versión 4.1 fue probada y confirmada como vulnerable, otras versiones no fueron probadas y también podrían ser vulnerables.

Information

Published : 2025-11-18 15:16

Updated : 2026-10-18 20:10

NVD link : CVE-2025-59117

Mitre link : CVE-2025-59117

CVE.ORG link : CVE-2025-59117

JSON object : View

Products Affected

windu

windu_cms

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-59117", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59117", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T15:42:00.755390Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "JCD", "product": "Windu CMS", "versions": [{"status": "affected", "changes": [{"at": "build 2250", "status": "unaffected"}], "version": "0", "versionType": "semver", "lessThanOrEqual": "4.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-18T15:16:34.337", "references": [{"url": "https://cert.pl/posts/2025/11/CVE-2025-59110", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://windu.org", "tags": ["Product"], "source": "cvd@cert.pl"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. \nThis vulnerability can be exploited by a privileged user and may target users with higher privileges.\n\nOnly version 4.1 was tested and confirmed as vulnerable.\nThis issue was fixed in version 4.1 build 2250."}, {"lang": "es", "value": "Windu CMS es vulnerable a m\u00faltiples vulnerabilidades de Cross-Site Scripting (XSS) Almacenado en el endpoint de edici\u00f3n de p\u00e1ginas windu/admin/content/pages/edit/.\nEsta vulnerabilidad puede ser explotada por un usuario privilegiado y puede tener como objetivo a usuarios con privilegios superiores.\n\nEl proveedor fue notificado con antelaci\u00f3n sobre esta vulnerabilidad, pero no respondi\u00f3 con los detalles de la vulnerabilidad o el rango de versiones vulnerables. Solo la versi\u00f3n 4.1 fue probada y confirmada como vulnerable, otras versiones no fueron probadas y tambi\u00e9n podr\u00edan ser vulnerables."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:windu:windu_cms:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "614EBC19-889B-4FC0-8937-C52F415D4835"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}