{"id":"EM-20261109-HWL2","url":"https://cyber.eventmonitor.net/incident/EM-20261109-HWL2/widzialnicms-vulnerability-cve-2026-112205/","type":"cve","title":"WidzialniCMS Vulnerability (CVE-2026-112205)","subtitle":"CVE-2026-112205","subject":"CVE-2026-112205","status":"Developing","severity":"medium","affected":[],"headline":null,"born":"2026-11-09T12:49:45.000Z","firstSignal":"2026-11-09T10:55:00.000Z","lastSignal":"2026-11-09T12:49:45.000Z","updated":"2026-11-09T15:18:40.970Z","revision":1,"life":[{"status":"Born","at":"2026-11-09T12:49:45.000Z","why":"second independent source: C8 EU Vulnerability Database (EUVD)"},{"status":"Developing","at":"2026-11-09T12:49:45.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-09T10:55:00.000Z","what":"First signal: C17 CERT Polska"},{"at":"2026-11-09T12:49:45.000Z","what":"Born: second source, C8 EU Vulnerability Database (EUVD). Page EM-20261109-HWL2 created."}],"stages":[{"name":"Disclosed","at":"2026-11-09T13:17:04.953Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-09T13:17:04.953Z","detail":"CVSS 6.9"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":"2026-11-09T10:55:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-09T10:55:00.000Z","source":"C17","sourceName":"CERT Polska","role":"Government","severity":2,"title":"Vulnerabilities in WidzialniCMS software","text":"CERT Polska coordinated disclosure of 4 vulnerabilities (CVE-2026-110468, CVE-2026-110469, CVE-2026-112204 and CVE-2026-112205) found in WidzialniCMS software.","url":"https://cert.pl/en/posts/2026/11/CVE-2026-110468/"},{"at":"2026-11-09T12:49:45.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":2,"title":"EUVD-2026-120047 / CVE-2026-112205 (score 6.9)","text":"WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts. This issue has been fixed in…","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120047"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-09T13:17:04.953","score":6.9,"severity":"MEDIUM","desc":"WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.\n\n\n\n\nThis issue has been…","product":"","seen":1794237520970},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}