CVE-2026-63179 | Medium | 4.9 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose… |
CVE-2026-54256 | Medium | 5.4 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget truste… |
CVE-2026-32639 | Medium | 6.8 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handl… |
CVE-2026-32593 | Medium | 5.9 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable t… |
CVE-2026-35445 | | | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submit… |
CVE-2026-32258 | High | 8.1 | 2026-08-26 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with… |
CVE-2026-32257 | High | 8.1 | 2026-08-26 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settin… |
CVE-2026-79774 | High | 8.4 | 2026-08-25 | Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated b… |
CVE-2026-79773 | Medium | 4.9 | 2026-08-25 | Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets… |
CVE-2026-27591 | Critical | 9.9 | 2026-03-11 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed auth… |
CVE-2026-22254 | Unrated | | 2026-02-06 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access… |
CVE-2024-54149 | High | 8.4 | 2024-12-09 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow… |
CVE-2024-32003 | High | 8.8 | 2024-04-12 | wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS. The Dusk plugin provides some special routes as part of… |
CVE-2024-29686 | High | 7.2 | 2024-03-29 | Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS P… |
CVE-2023-52085 | Low | 3.3 | 2023-12-29 | Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that woul… |
CVE-2023-52084 | Low | 2.0 | 2023-12-28 | Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a… |
CVE-2023-52083 | Low | 2.0 | 2023-12-28 | Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager… |
CVE-2023-37269 | Low | 2.0 | 2023-07-07 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can uploa… |
CVE-2022-39357 | High | 8.1 | 2022-10-26 | Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vuln… |