wintercms winter

• CVE-2026-63179 Medium 4.9 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets 0.5%
• CVE-2026-54256 Medium 5.4 Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata 0.2%
• CVE-2026-32639 Medium 6.8 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads 0.5%
• CVE-2026-32593 Medium 5.9 Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax 0.3%
• CVE-2026-32258 High 8.1 Winter: Stored XSS through Editor Settings custom styles 0.4%
• CVE-2026-32257 High 8.1 Winter: Stored XSS through Brand Settings custom styles 0.4%
• CVE-2026-35445 High 7.1 Winter: Authenticated backend users can bypass Users controller permission checks 0.4%
• CVE-2026-79774 High 8.4 Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy 0.8%
• CVE-2026-79773 Medium 4.9 Winter CMS before 1.2.13 Local File Inclusion via JavaScript 0.5%
• CVE-2026-27591 Critical 10.0 Winter: Privilege escalation by authenticated backend users 0.8%
• CVE-2026-22254 None 0.0 Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager 0.3%
• CVE-2024-54149 High 8.5 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion 0.4%
• CVE-2023-52085 Low 3.3 Winter CMS Local File Inclusion through Server Side Template Injection 30.2%
• CVE-2023-52084 Low 2.0 Winter CMS Stored XSS through Backend ColorPicker FormWidget 0.3%
• CVE-2023-52083 Low 2.0 Stored XSS through privileged upload of Media Manager file followed by renaming 0.3%
• CVE-2023-37269 Low 2.0 Winter CMS vulnerable to stored XSS through privileged upload of SVG file 2.7%
• CVE-2022-39357 High 8.1 Winter vulnerable to Prototype Pollution in Snowboard framework 1.4%