Vulnerabilities

TI-2026-21979 CVE-2026-27591 · GHSA-pgpf-m8m4-6cg6

Winter: Privilege escalation by authenticated backend users

MEDIUM 44

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00777 Published 2026-03-11 Fixed in 1.2.12, 1.1.12 +1 CWE-284

TI-2026-17864 CVE-2026-22254 · GHSA-m7gw-rffq-rxjm

Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager

LOW 17

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00286 Published 2026-02-06 Fixed in 1.2.10 CWE-79

TI-2024-36264 CVE-2024-54149 · GHSA-xhw3-4j3m-hq53

Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

LOW 39

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1HIGH 8.5 Network High privileges User interaction EPSS 0.0042 Published 2024-12-09 Fixed in 1.2.7, 1.1.11 +1 CWE-184

TI-2024-19497 CVE-2024-29686 · GHSA-8r5j-gm3j-cx9c

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote…

HIGH 67

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01821 Published 2024-03-29 No fix listed CWE-97

TI-2023-28528 CVE-2023-52085 · GHSA-2x7r-93ww-cxrq

Winter CMS Local File Inclusion through Server Side Template Injection

MEDIUM 48

Winter is a free, open-source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.30166 Published 2023-12-29 Fixed in 1.2.4 CWE-22

TI-2023-28527 CVE-2023-52084 · GHSA-43w4-4j3c-jx29

Winter CMS Stored XSS through Backend ColorPicker FormWidget

LOW 24

Winter is a free, open-source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00309 Published 2023-12-28 Fixed in 1.2.4 CWE-79

TI-2023-28526 CVE-2023-52083 · GHSA-4wvw-75qh-fqjp

Stored XSS through privileged upload of Media Manager file followed by renaming

LOW 22

Winter is a free, open-source content management system.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00311 Published 2023-12-28 Fixed in 1.2.4 CWE-79

TI-2023-18899 CVE-2023-37269 · GHSA-wjw2-4j7j-6gc3

Winter CMS vulnerable to stored XSS through privileged upload of SVG file

LOW 27

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.027 Published 2023-07-07 Fixed in 1.2.3 CWE-79

TI-2022-18732 CVE-2022-39357 · GHSA-3fh5-q6fg-w28q

Winter vulnerable to Prototype Pollution in Snowboard framework

MEDIUM 46

Winter is a free, open-source content management system based on the Laravel PHP framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01366 Published 2022-10-26 Fixed in 1.1.10, 1.2.1 CWE-1321

Vulnerabilities

Filters