# CVE-2025-59116: Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could…

Source: https://junglewise.ai/threats/cve-2025-59116-windu-cms-is-vulnerable-to-user-enumeration-this-issue-occurs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18  
License: CC BY 4.0 with a link back

CVE-2025-59116 · Severity: medium · CVSS 5.3 · Published 2025-11-18

Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.

Technologies: [Windu Cms](https://junglewise.ai/threats/technologies/windu-windu-cms). Vendors: [Windu](https://junglewise.ai/threats/vendors/windu).

## Quick answers

**Is CVE-2025-59116 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59116 being exploited in the wild.

**How severe is CVE-2025-59116?** Medium severity, with a CVSS score of 5.3, published 18 November 2025.

**Which products and versions are affected?** Windu Cms. The advisory does not name versions.

**Is there a fix for CVE-2025-59116?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-59116?** Check whether you run Windu Cms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Windu Cms

## Related threats

- [Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint…](https://junglewise.ai/threats/cve-2025-59117-windu-cms-is-vulnerable-to-multiple-stored-cross-site-scripting)
- [Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper…](https://junglewise.ai/threats/cve-2025-59115-windu-cms-is-vulnerable-to-stored-cross-site-scripting-xss-in-the)
- [Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft…](https://junglewise.ai/threats/cve-2025-59114-windu-cms-is-vulnerable-to-cross-site-request-forgery-in-file)
- [Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt…](https://junglewise.ai/threats/cve-2025-59113-windu-cms-implements-weak-client-side-brute-force-protection-by)
- [Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Malicious attacker can craft…](https://junglewise.ai/threats/cve-2025-59112-windu-cms-is-vulnerable-to-cross-site-request-forgery-in-user)