CVE-2026-57309
Windu CMS has a critical blind SQL injection vulnerability that allows unauthenticated attackers to inject SQL via the URL path in HTTP headers. The flaw was confirmed in version 4.1 and could affect other versions. It can lead to data exposure or manipulation.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Windu CMS, version 4.1 (and possibly earlier or later versions).
Real-world impact
An attacker could extract sensitive data or modify the database without authentication, potentially compromising the entire site.
Why this severity
The CVSS score of 9.3 reflects the high impact of the vulnerability: it is exploitable remotely without authentication or user interaction, and it can lead to complete compromise of the database. The lack of required privileges and the ability to affect the database integrity and confidentiality contribute to the critical rating.
What to do about it
- ›Monitor the vendor for an official patch or upgrade to a newer, unpatched version if available.
- ›Restrict access to the vulnerable component or disable the affected feature until a fix is released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.