CVE-2026-57310
Received Received - Intake

Password Hashing Weakness in Windu CMS

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: CERT.PL

Description
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-57310
EUVD
EUVD-2026-45944

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
windu cms From 4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-916 The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Windu CMS stores user passwords using weak hashing algorithms MD5 and SHA1 with a static salt. This makes passwords vulnerable to being decoded if an attacker obtains the password hashes.

Detection Guidance

Detecting this vulnerability requires checking if Windu CMS is installed and verifying if it uses MD5 or SHA1 with static salt for password hashing. Inspect configuration files and database entries for password storage methods. No specific commands are provided in the context.

Impact Analysis

An attacker who gains access to password hashes could decode user credentials, potentially leading to unauthorized account access and data breaches. This affects all users with accounts on the vulnerable system.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA due to inadequate password security measures. It may result in non-compliance penalties and increased risk of data exposure.

Mitigation Strategies

Immediately upgrade Windu CMS to a version that does not use MD5 or SHA1 with static salt for password storage. If upgrading is not possible, consider migrating to an alternative CMS with stronger password hashing. Rotate all user passwords after mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart