CVE-2026-32258

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...

CVE-2026-32258

Winter CMS (a Laravel-based PHP CMS) versions 1.2.10 through 1.2.12 are vulnerable to stored XSS when authenticated backend users with the backend.manage_editor permission inject malicious code via Editor Settings → Markup Styles . The custom styles are compiled by the LESS parser and rendered un...

EUVD-2026-66633

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...

CVE-2025-61674 October CMS Vulnerable to Stored XSS via Editor and Branding Styles

October is a Content Management System CMS and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting XSS vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the styleshee...

PT-2023-11733

Name of the Vulnerable Software and Affected Versions Lepton-CMS version 4.7.0 Description The issue is a Cross Site Scripting XSS vulnerability in the backend/pages/modify.php file, which allows remote attackers to execute arbitrary code. This can be exploited by attackers to inject malicious...

CVE-2020-24872: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code...

LeptonCMS cross-site scripting vulnerability

LeptonCMS is a content management system CMS. A cross-site scripting vulnerability exists in LeptonCMS version 4.7.0, which stems from the lack of effective filtering and escaping of user-supplied data in the backend/pages/modify.php file, which can be exploited by an attacker to execute arbitrar...

Amr Users < 4.59.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in the "Name of list" field in the User Lists Overview ...

Directory Traversal Vulnerability in Xunrui CMS Backend Pages

Sichuan Xunruiyun Software Development Co., Ltd. is an Internet enterprise focusing on providing informatization services for small and medium-sized enterprises, mainly engaged in PHP language CMS website management system, offline communication and information engineering, online and offline...

CVE-2018-16635

Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php...

CVE-2018-16635

Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php...

CVE-2018-16635: Improper Neutralization of Input During Web Page Generation

Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php...

PT-2018-13662

Name of the Vulnerable Software and Affected Versions Blackcat CMS version 1.3.2 Description The issue allows for XSS via the page title at backend/pages/modify.php, specifically when accessing the willkommen.php?lang=DE page. Recommendations For Blackcat CMS version 1.3.2, update the modify.php...

BlackCat CMS Cross-Site Scripting Vulnerability (CNVD-2018-14549)

BlackCatCMS is an open source content management system CMS that supports both English and German. A cross-site scripting vulnerability exists in the backend/pages/modify.php file in BlackCatCMS version 1.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML v...

CVE-2018-10821

Cross-site scripting XSS vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel...

CVE-2018-10821: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel...

PT-2018-10127

Name of the Vulnerable Software and Affected Versions BlackCatCMS version 1.3 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel in backend/pages/modify.php. Recommendations For...

CVE-2017-9609

Cross-site scripting XSS vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the maplanguage parameter to backend/pages/langsettings.php...

CVE-2017-9609: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the maplanguage parameter to backend/pages/langsettings.php...

PT-2017-19068

Name of the Vulnerable Software and Affected Versions Blackcat CMS version 1.2 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the map language parameter to "backend/pages/lang settings.php". Recommendations For Blackcat CM...