PT-2026-140403

CVE-2026-112205

·

Published

2026-11-09

·

Updated

2026-11-09

Description by

CVSS 4.0
6.9
Medium
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login count and login timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.
This issue has been fixed in version 2.5.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-307: Improper Restriction of Excessive Authentication Attempts
Related identifiers
CVE-2026-112205
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com