Is CVE-2026-57309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57309 being exploited in the wild.

How severe is CVE-2026-57309?

Informational severity, with a CVSS score of 9.3, published 20 July 2026.

Is there a fix for CVE-2026-57309?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57309 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57309?

Check whether you run JCD Windu CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57309: JCD Windu CMS blind SQL injection in URL path

CVE-2026-57309 · Severity: info · CVSS 9.3 · Published 2026-07-20

Windu CMS, a content management system used for building and managing websites, is vulnerable to a blind SQL injection attack. An unauthenticated remote attacker can exploit this flaw to interact directly with the website's database. This could lead to the unauthorized extraction of sensitive information, such as user credentials or customer data, and potentially disrupt website operations.

Technologies: JCD Windu CMS. Vendors: JCD.

Quick answers

Is CVE-2026-57309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57309 being exploited in the wild.
How severe is CVE-2026-57309?: Informational severity, with a CVSS score of 9.3, published 20 July 2026.
Which products and versions are affected?: JCD Windu CMS 4.1.
Is there a fix for CVE-2026-57309?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57309 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57309?: Check whether you run JCD Windu CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Blind SQL injection vulnerability exists in Windu CMS version 4.1 due to improper neutralization of special elements used in an SQL command (CWE-89). The flaw is located in the processing of the URL path within HTTP headers. A remote, unauthenticated attacker can send specially crafted HTTP requests to inject SQL syntax, allowing them to infer data from the database through boolean-based or time-based blind techniques. Successful exploitation can lead to full data exfiltration from the underlying SQLite database. As vendor contact attempts were unsuccessful, no official patch is currently available.

Affected products

JCD Windu CMS 4.1

Timeline

2026-07-20: advisory: Advisory published by CERT.PL
2026-07-20: disclosed: CVE-2026-57309 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.