WI
Vendor
wintercms
18
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-63179 | WI winter wintercms | 4.9 | Aug 26 | Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets |
| CVE-2026-54256 | WI winter wintercms | 5.4 | Aug 26 | Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata |
| CVE-2026-32639 | WI winter wintercms | 6.8 | Aug 26 | Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads |
| CVE-2026-32593 | WI winter wintercms | 5.9 | Aug 26 | Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax |
| CVE-2026-32258 | WI winter wintercms | 8.1 | Aug 26 | Winter: Stored XSS through Editor Settings custom styles |
| CVE-2026-32257 | WI winter wintercms | 8.1 | Aug 26 | Winter: Stored XSS through Brand Settings custom styles |
| CVE-2026-35445 | WI winter wintercms | 7.1 | Aug 26 | Winter: Authenticated backend users can bypass Users controller permission checks |
| CVE-2026-79774 | WI winter wintercms | 8.4 | Aug 25 | Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy |
| CVE-2026-79773 | WI winter wintercms | 4.9 | Aug 25 | Winter CMS before 1.2.13 Local File Inclusion via JavaScript |
| CVE-2026-27591 | WI winter wintercms | 9.9 | Mar 11 | Winter: Privilege escalation by authenticated backend users |
| CVE-2026-22254 | WI winter wintercms | 3.5 | Feb 6 | Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager |
| CVE-2024-54149 | WI winter wintercms | 8.4 | Dec 9 | Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion |
| CVE-2024-29686 | WI Winter Wintercms | 7.2 | Mar 29 | Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and… |
| CVE-2023-52085 | WI Winter Wintercms | 5.4 | Dec 29 | Winter is a free, open-source content management system |
| CVE-2023-52084 | WI Winter Wintercms | 5.4 | Dec 28 | Winter is a free, open-source content management system |
| CVE-2023-52083 | WI Winter Wintercms | 4.8 | Dec 28 | Winter is a free, open-source content management system |
| CVE-2023-37269 | WI Winter Wintercms | 4.8 | Jul 7 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework |
| CVE-2022-39357 | WI winter wintercms | 9.8 | Oct 26 | Winter vulnerable to Prototype Pollution in Snowboard framework |