Windu CMS 4.1 patches eight critical security flaws
CERT Polska disclosed eight vulnerabilities in Windu CMS 4.1, including CSRF, broken access control, XSS, and authentication bypass flaws—all patched in build 2250.
Sourcecert.pl — open the original
What to check
- Applies to
- The 8 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of eight vulnerabilities affecting Windu CMS version 4.1, following a responsible disclosure report from researcher Karol Czubernat. The vulnerabilities span multiple categories including Cross-Site Request Forgery (CSRF) flaws in user editing and file upload functions, broken access control allowing unauthorized deletion of Super Admin accounts, and multiple stored Cross-Site Scripting (XSS) issues. Additional weaknesses include client-side brute-force protection that can be trivially bypassed and user enumeration during authentication.
The most severe issues enable attackers to manipulate administrative accounts through CSRF attacks—bypassing token validation by reusing tokens from other users, deleting Super Admin accounts via direct GET requests, and forcing administrators to delete users or upload malicious files by visiting attacker-controlled websites. The stored XSS vulnerabilities allow privilege escalation where lower-privileged users can inject malicious scripts that execute when administrators view logs or edit pages.
All identified vulnerabilities were patched in Windu CMS version 4.1 build 2250. Organizations running earlier builds of version 4.1 should update immediately. The vendor has been responsive throughout the coordinated disclosure process.
Mentioned in this report
Detection guidance
Repeated Failed CMS Admin Login Attempts (Client-Side Brute-Force Bypass)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a pattern of repeated failed authentication requests against a CMS login endpoint from a single source, indicating brute-force attempts against accounts where client-side lockout protections can be trivially bypassed (e.g., by disabling JavaScript or replaying requests directly). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Failed CMS Admin Login Attempts (Client-Side Brute-Force Bypass)
id: 07098d91-4211-5880-bdf9-148ae153cc0a
status: experimental
description: Detects multiple failed login POST requests to the CMS authentication
endpoint from the same source, consistent with brute-force or credential-stuffing
attempts bypassing weak client-side lockout controls. Threshold/time-window correlation
(e.g., more than 10 failed attempts within 5 minutes from one IP) should be enforced
in the SIEM correlation layer, not in this rule's condition.
references:
- CERT Polska Windu CMS 4.1 disclosure
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-query|contains:
- /login
- /admin/login
- auth
sc-status:
- 401
- 403
condition: selection
fields:
- c-ip
- cs-username
- sc-status
- cs-uri-query
falsepositives:
- Legitimate users mistyping credentials repeatedly
- Automated uptime/health-check monitors hitting the login endpoint
level: medium
tags:
- attack.t1110
- attack.t1078
author: Vorant
Stored XSS Payload Submitted via CMS Input Fields
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests carrying script-injection payloads (script tags, javascript: URIs, event handlers) in CMS form parameters such as log entries or page edit fields, consistent with the stored XSS vulnerabilities disclosed for Windu CMS that trigger when an admin views logs or edits pages. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Stored XSS Payload Submitted via CMS Input Fields
id: 5d2a5018-088f-583e-a779-c1d748fe1d05
status: experimental
description: Detects request bodies/query strings containing common script-injection
markers submitted to CMS content, log, or page-edit endpoints, matching the stored
XSS pattern disclosed in Windu CMS where low-privileged input is later rendered
for admins.
references:
- CERT Polska Windu CMS 4.1 disclosure
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-query|contains:
- /log
- /edit
- /page
- /comment
selection_payload:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
condition: selection_endpoint and selection_payload
fields:
- cs-uri-query
- c-ip
- cs-username
falsepositives:
- Security scanners or penetration testers probing the CMS for XSS
- Legitimate content containing code snippets that include the word script or onload
as documentation text
level: high
tags:
- attack.t1059.007
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/11/CVE-2025-59110
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs