Wintercms
Monthly
Authenticated Twig sandbox escape in Winter CMS before 1.2.13 lets backend users holding template-editing permissions (cms.manage_pages, cms.manage_layouts, or cms.manage_partials) break out of the CMS 'safe mode' to read and modify arbitrary database records, run raw SQL including DDL like DROP TABLE, exfiltrate backend administrator credentials, and achieve PHP remote code execution by writing PHP into a page, layout, or partial code section. It is an incomplete-fix follow-up (bypass) of CVE-2024-54149, whose method-name blocklist missed Eloquent's __call forwarding to the query builder. Rated CVSS 4.0 9.3 (VulnCheck); no public exploit is identified as actively used, though the vendor advisory and added test cases publish working payloads.
Local file inclusion in Winter CMS before 1.2.13 allows authenticated backend users holding the cms.manage_assets permission to exfiltrate arbitrary server-readable files - including .env - by embedding =include or =require path-traversal directives in theme JavaScript assets. The critical escalation is that the resulting combined asset output is served unauthenticated via the public combine/{file} route, meaning a single privileged write operation exposes APP_KEY and database credentials to any unauthenticated visitor. This is the JavaScript-importer counterpart of two prior Winter CMS LFI bugs (GHSA-58fp-mcx6-7qf9, CVE-2023-52085) in the same asset combiner pipeline. No public exploit identified at time of analysis; vendor-released patch available in 1.2.13.
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization.
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity.
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Winter is a free, open-source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Winter is a free, open-source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Winter is a free, open-source content management system. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Winter is a free, open-source content management system based on the Laravel PHP framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
Authenticated Twig sandbox escape in Winter CMS before 1.2.13 lets backend users holding template-editing permissions (cms.manage_pages, cms.manage_layouts, or cms.manage_partials) break out of the CMS 'safe mode' to read and modify arbitrary database records, run raw SQL including DDL like DROP TABLE, exfiltrate backend administrator credentials, and achieve PHP remote code execution by writing PHP into a page, layout, or partial code section. It is an incomplete-fix follow-up (bypass) of CVE-2024-54149, whose method-name blocklist missed Eloquent's __call forwarding to the query builder. Rated CVSS 4.0 9.3 (VulnCheck); no public exploit is identified as actively used, though the vendor advisory and added test cases publish working payloads.
Local file inclusion in Winter CMS before 1.2.13 allows authenticated backend users holding the cms.manage_assets permission to exfiltrate arbitrary server-readable files - including .env - by embedding =include or =require path-traversal directives in theme JavaScript assets. The critical escalation is that the resulting combined asset output is served unauthenticated via the public combine/{file} route, meaning a single privileged write operation exposes APP_KEY and database credentials to any unauthenticated visitor. This is the JavaScript-importer counterpart of two prior Winter CMS LFI bugs (GHSA-58fp-mcx6-7qf9, CVE-2023-52085) in the same asset combiner pipeline. No public exploit identified at time of analysis; vendor-released patch available in 1.2.13.
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization.
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity.
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Winter is a free, open-source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Winter is a free, open-source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Winter is a free, open-source content management system. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Winter is a free, open-source content management system based on the Laravel PHP framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.