Priority HIGH 67
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01821 · Published 2024-03-29 · No fix listed CWE-97
Priority MEDIUM 48
Winter is a free, open-source content management system.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.30166 · Published 2023-12-29 · Fixed in 1.2.4 CWE-22
Priority MEDIUM 46
Winter is a free, open-source content management system based on the Laravel PHP framework.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01366 · Published 2022-10-26 · Fixed in 1.1.10, 1.2.1 CWE-1321
Priority MEDIUM 44
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sand…
CVSS 4.0CRITICAL 9.3· Network · High privileges · User interaction · EPSS 0.00808 · Published 2026-08-25 · Fixed in 1.2.13 CWE-693
Priority MEDIUM 44
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.
CVSS 3.1CRITICAL 10.0· Network · Low privileges · No interaction · EPSS 0.00777 · Published 2026-03-11 · Fixed in 1.2.12, 1.1.12 +1 CWE-284
Priority MEDIUM 41
wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00672 · Published 2024-04-12 · Fixed in 2.1.0 CWE-269
Priority LOW 39
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.
CVSS 3.1HIGH 8.5· Network · High privileges · User interaction · EPSS 0.0042 · Published 2024-12-09 · Fixed in 1.2.7, 1.1.11 +1 CWE-184
Priority LOW 37
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.
CVSS 3.1HIGH 8.1· Network · High privileges · User interaction · EPSS 0.00382 · Published 2026-08-26 · Fixed in 1.2.13 CWE-79
Priority LOW 37
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.
CVSS 3.1HIGH 8.1· Network · High privileges · User interaction · EPSS 0.00382 · Published 2026-08-26 · Fixed in 1.2.13 CWE-79
Priority LOW 32
Winter CMS is a content management system built on the Laravel PHP framework.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00439 · Published 2026-08-26 · Fixed in 1.2.13 CWE-285
Priority LOW 31
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by pla…
CVSS 4.0MEDIUM 6.9· Network · High privileges · No interaction · EPSS 0.00493 · Published 2026-08-25 · Fixed in 1.2.13 CWE-22
Priority LOW 30
Winter CMS is a content management system built on the Laravel PHP framework.
CVSS 3.1MEDIUM 6.8· Network · High privileges · No interaction · EPSS 0.00459 · Published 2026-08-26 · Fixed in 1.2.13 CWE-289
Priority LOW 27
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.027 · Published 2023-07-07 · Fixed in 1.2.3 CWE-79
Priority LOW 26
Winter CMS is a content management system built on the Laravel PHP framework.
CVSS 3.1MEDIUM 5.9· Network · Low privileges · No interaction · EPSS 0.00274 · Published 2026-08-26 · Fixed in 1.2.13 CWE-89
Priority LOW 24
Winter CMS is a content management system built on the Laravel PHP framework.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00239 · Published 2026-08-26 · Fixed in 1.2.13 CWE-284
Priority LOW 24
Winter is a free, open-source content management system.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00309 · Published 2023-12-28 · Fixed in 1.2.4 CWE-79
Priority LOW 23
Winter CMS is a content management system built on the Laravel PHP framework.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00515 · Published 2026-08-26 · Fixed in 1.2.13 CWE-22
Priority LOW 22
Winter is a free, open-source content management system.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00311 · Published 2023-12-28 · Fixed in 1.2.4 CWE-79
Priority LOW 17
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.
CVSS 3.1LOW 3.5· Network · High privileges · User interaction · EPSS 0.00286 · Published 2026-02-06 · Fixed in 1.2.10 CWE-79
THREATIST.IORead the docs