CVE-2026-57311

MediumCVSS 5.3/10Last modified Oct 24, 2026

Description

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

Metrics

CVSS 4.0 5.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jul 20, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-573127.1Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.CVE-2026-573136.5Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.CVE-2026-573147.1Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.CVE-2026-573158.5Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.CVE-2026-573166.5Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.CVE-2026-573177.1Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.CVE-2026-573186.5Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.CVE-2026-573197.1Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.CVE-2026-57328.8Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESCVE-2026-573207.1Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.CVE-2026-573217.1Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.CVE-2026-573227.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected
CVE-2026-57311: Medium severity, CVSS 5.3 | Vulnix