CVE-2026-16337

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote co...

Exploit for CVE-2026-16219

CVE-2026-16219: Croogo FileManager defensive lab !Safety: l...

CVE-2026-57311

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-57310

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also...

CVE-2026-57311

Windu CMS is affected by CVE-2026-57311 due to lack of validation for uploaded file types. An authenticated attacker can upload arbitrary files, including PHP, which can lead to Remote Code Execution. The vulnerability has been confirmed in version 4.1 and may affect other versions; the available...

EUVD-2026-45945

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-57311 Unrestricted Upload of File with Dangerous Type in Windu CMS

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-57311 Unrestricted Upload of File with Dangerous Type in Windu CMS

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-57311

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-57310

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also...

CVE-2026-57310

Windu CMS stores user passwords using a weak scheme: an MD5/SHA1-based hash with a static salt. This design allows an attacker who obtains password hashes to recover credentials. The vulnerability is confirmed in version 4.1 and may affect other versions; exploitation details are not provided in ...

CVE-2026-57310 Weak password hashing in Windu CMS

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also...

CVE-2026-57309 Blind SQL Injection in Windu CMS

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...

CVE-2026-57309 Blind SQL Injection in Windu CMS

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...

CVE-2026-57309

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...

CVE-2026-57309

CVE-2026-57309 involves a Blind SQL injection in Windu CMS. The vulnerability allows a remote, unauthenticated attacker to inject SQL syntax into the URL path in the HTTP header, leading to Blind SQL Injection. It has been confirmed in version 4.1 and may affect other versions. The report cites a...

SUSE-SU-2026:22757-1 Security update for gpg2

This update for gpg2 fixes the following issue: - CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM bsc1269279...

OPENSUSE-SU-2026:21385-1 Security update for gpg2

This update for gpg2 fixes the following issue: - CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM bsc1269279...

PT-2026-61589

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-57309: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...