Wintercms
Vulnerability activity for Wintercms: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 8
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 4.3MediumNov 10, 2026Wintercms winter Auth bypass / access controlCVE-2026-126061Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions array, and formFindModelObject() resolves a caller-supplied record identifier through an unscoped Backend\Models\User query. Any authenticated backend user can request another sequential user identifier through /backend/backend/myaccount/pre
- 2.0LowNov 10, 2026Wintercms winter XSSCVE-2026-125341Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backe
- 4.5MediumNov 10, 2026Wintercms winter XSSCVE-2026-125340Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in a crafted top-level GET URL terminates the raw-text template and causes the remaining input to be parsed as backend markup, even when the widget uses searching: false. Any Table or DataTable page is a s
- 6.1MediumNov 10, 2026Wintercms winter CSRFCVE-2026-125339Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized bac
- 4.5MediumNov 10, 2026Wintercms winter XSSCVE-2026-125338Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The first render after saving custom CSS appears sanitized while priming an unsafe cache entry, and later cache hits return unsanitized output into the backend style element, allowing a user with backend.manage_branding or backe
- 8.3HighNov 10, 2026Wintercms winter Auth bypass / access controlCVE-2026-125337Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated
- 9.9CriticalMar 11, 2026Wintercms winter Auth bypass / access controlCVE-2026-27591Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access
- 0.0NoneFeb 6, 2026Wintercms winter XSSCVE-2026-22254Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to
Top products
- winter8 CVEs in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.