CVE-2026-125337

Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess only to the import and export page actions, while Backend\Classes\Controller::execAjaxHandlers dispatches onImport, onImportLoadForm,...

CVE-2026-125337 Winter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate

Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess only to the import and export page actions, while Backend\Classes\Controller::execAjaxHandlers dispatches onImport, onImportLoadForm,...

CVE-2026-125337

Prior to version 1.2.14 , Winter CMS (built on Laravel) contained a broken access control vulnerability in the ImportExportController . While granular permissions for import/export operations were configured, the userHasAccess() check was only applied to specific page actions. Consequently, AJAX ...

EUVD-2026-122882

Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess only to the import and export page actions, while Backend\Classes\Controller::execAjaxHandlers dispatches onImport, onImportLoadForm,...

CVE-2016-1606

Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via 1 the NetworkName property value to ObjectXSNAConfig.ObjectXSNAConfig in iconfig.dll, 2 the CPName property value to...