Wintercms - vulnerabilities (CVEs)

19 CVEs in 2 products, 0 in the last 30 days, newest from 2026-08-26.

Products

Winter - 15 CVEs
Wn-dusk-plugin - 1 CVEs

Newest CVEs of Wintercms

CVE-2026-63179 - CVSS 4.9 (medium), 2026-08-26: Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose…
CVE-2026-54256 - CVSS 5.4 (medium), 2026-08-26: Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget…
CVE-2026-32639 - CVSS 6.8 (medium), 2026-08-26: Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX…
CVE-2026-32593 - CVSS 5.9 (medium), 2026-08-26: Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable…
CVE-2026-32258 - CVSS 8.1 (high), 2026-08-26: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with…
CVE-2026-32257 - CVSS 8.1 (high), 2026-08-26: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand…
CVE-2026-35445 - CVSS 7.1 (high), 2026-08-26: Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name…
CVE-2026-79773 - CVSS 6.9 (medium), 2026-08-25: Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets…
CVE-2026-79774 - CVSS 9.3 (critical), 2026-08-25: Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated…
CVE-2026-27591 - CVSS 10 (critical), 2026-03-11: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed…
CVE-2026-22254 - CVSS 3.5 (low), 2026-02-06: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access…
CVE-2024-54149 - CVSS 8.5 (high), 2024-12-09: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476…
CVE-2024-32003 - CVSS 8.8 (high), 2024-04-12: wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS. The Dusk plugin provides some special routes as part…
CVE-2024-29686 - CVSS 7.2 (high), 2024-03-29: Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS…
CVE-2023-52085 - CVSS 5.4 (medium), 2023-12-29: Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that…
CVE-2023-52084 - CVSS 5.4 (medium), 2023-12-28: Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide…
CVE-2023-52083 - CVSS 4.8 (medium), 2023-12-28: Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager…
CVE-2023-37269 - CVSS 4.8 (medium), 2023-07-07: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can…
CVE-2022-39357 - CVSS 9.8 (critical), 2022-10-26: Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is…