# CVE-2025-59113: Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt…

Source: https://junglewise.ai/threats/cve-2025-59113-windu-cms-implements-weak-client-side-brute-force-protection-by  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18  
License: CC BY 4.0 with a link back

CVE-2025-59113 · Severity: high · CVSS 7.5 · Published 2025-11-18

Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.

Technologies: [Windu Cms](https://junglewise.ai/threats/technologies/windu-windu-cms). Vendors: [Windu](https://junglewise.ai/threats/vendors/windu).

## Quick answers

**Is CVE-2025-59113 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59113 being exploited in the wild.

**How severe is CVE-2025-59113?** High severity, with a CVSS score of 7.5, published 18 November 2025.

**Which products and versions are affected?** Windu Cms. The advisory does not name versions.

**Is there a fix for CVE-2025-59113?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-59113?** Check whether you run Windu Cms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Windu Cms

## Related threats

- [Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint…](https://junglewise.ai/threats/cve-2025-59117-windu-cms-is-vulnerable-to-multiple-stored-cross-site-scripting)
- [Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could…](https://junglewise.ai/threats/cve-2025-59116-windu-cms-is-vulnerable-to-user-enumeration-this-issue-occurs)
- [Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper…](https://junglewise.ai/threats/cve-2025-59115-windu-cms-is-vulnerable-to-stored-cross-site-scripting-xss-in-the)
- [Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft…](https://junglewise.ai/threats/cve-2025-59114-windu-cms-is-vulnerable-to-cross-site-request-forgery-in-file)
- [Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Malicious attacker can craft…](https://junglewise.ai/threats/cve-2025-59112-windu-cms-is-vulnerable-to-cross-site-request-forgery-in-user)