CVE-2026-125340

Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in ...

CVE-2026-125340

Winter CMS versions 1.0.420 through 1.2.14 are vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in the backend Table widget (modules/backend/widgets/table/partials/_table.php). The application fails to HTML-encode the search query parameter when rendering it inside a `[removed]