Unrated severityNVD Advisory· Published Nov 18, 2025· Updated Dec 5, 2025
Stored XSS in Windu CMS
CVE-2025-59115
Description
Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Malicious attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting logs page by admin.
Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.
Affected products
2- JCD/Windu CMSv5Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- cert.pl/posts/2025/11/CVE-2025-59110mitrethird-party-advisory
- windu.orgmitreproduct
News mentions
0No linked articles in our index yet.