WidzialniCMS has a vulnerability in its login functionality that allows bypassing brute force protection. The protection mechanism relies on cookies (login_count and login_timeout) to lock out repeated login attempts. An attacker can omit these cookies to bypass the lockout and perform unlimited login attempts. This issue is fixed in version 2.5.