CVE-2026-112205
MediumCVSS 6.9Summary
WidzialniCMS is vulnerable to brute force protection bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker unlimited login attempts. The issue is fixed in version 2.5.
Risk Assessment
An attacker could perform dictionary or brute force attacks without restriction, potentially leading to account takeover. The risk increases with weak passwords.
Recommendation
Update WidzialniCMS to version 2.5. Additionally, implement server-side login attempt throttling independent of cookies.
Other vulnerabilities in WidzialniCMS
See all- CVE-2026-112204Medium
WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare a URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g. session cookie theft. This issue has been fixed in version 2.5.
- CVE-2026-110469Critical
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
- CVE-2026-110468Critical
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
Original NVD description (English source)
WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts. This issue has been fixed in version 2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS