CVE-2023-52084

Winter CMS Stored XSS (CVE-2023-52084) : The vulnerability is in Winter CMS prior to 1.2.4 where a value entered in backend forms using the ColorPicker FormWidget could be rendered unescaped, enabling stored XSS. Affected: versions before 1.2.4; root cause: unescaped rendering of input in backend...

CVE-2023-52085

Winter CMS before 1.2.4 is vulnerable to Local File Inclusion through the ColorPicker FormWidget when backend forms pass values to LESS compilation. The root cause is unprocessed user input being included in generated stylesheets, enabling potential local file exposure. Affected component: ColorP...

CVE-2024-54149

Winter CMS has a sandbox bypass in Twig templates that affects versions prior to 1.2.7, 1.1.11, and 1.0.476. If an attacker has backend access with cms.manage_layouts, cms.manage_pages, or cms.manage_partials, they can modify or delete theme resources and potentially manipulate model data passed ...

CVE-2023-37269

Winter CMS is vulnerable to a stored XSS due to unsanitized SVG uploads in the branding logo function prior to v1.2.3. The issue requires an attacker with backend.manage_branding permission (or higher) and user interaction by visiting the URL of the malicious SVG; exploitation is further constrai...

CVE-2023-52083

CVE-2023-52083 affects Winter CMS. Before 1.2.4, users with the media.manage_media permission could upload files to the Media Manager and rename them after upload, with sanitization only on upload (not on rename), allowing a stored XSS vulnerability. The issue has been patched in v1.2.4.

CVE-2026-27591

CVE-2026-27591 pertains to Winter CMS (Laravel-based). The issue allows authenticated backend users to escalate their own access by mutating roles/permissions via specially crafted backend requests while logged in. Root cause is an authorization weakness in the backend account management flow. Im...

CVE-2026-22254

CVE-2026-22254 affects Winter CMS prior to 1.2.10, where the Asset Manager allowed uploading SVGs without automatic sanitization if a user had cms.manage_assets. This could enable stored XSS in affected deployments, since the attacker must have backend access with that permission. The issue is fi...