CVE-2026-57309 describes a Blind SQL Injection vulnerability in Windu CMS version 4.1. An attacker can remotely inject SQL commands through the URL path in HTTP headers without authentication. This improper neutralization of special elements in SQL commands (CWE-89) can lead to high-impact consequences such as data leakage or unauthorized database manipulation. Attempts to contact the vendor for remediation have been unsuccessful, and no official patch or fix has been published. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

The vulnerability allows remote unauthenticated attackers to perform Blind SQL Injection attacks against Windu CMS 4.1, potentially leading to unauthorized access to sensitive data or manipulation of the backend database. The critical CVSS score reflects the high risk of exploitation without any required privileges or user interaction. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since vendor contact attempts have been unsuccessful and no official fix is available, users of Windu CMS 4.1 should consider applying workarounds such as disabling vulnerable functionality if possible or restricting access to the affected endpoints until a patch is released.