Wintercms vulnerabilities
We track 10 vulnerabilities in Wintercms products across 2 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest Wintercms vulnerabilities
- 8.3 High severity
winter: Missing Authorization
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() disp
- 7.1 High severity
winter: Improper Authorization
Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke a
- 8.1 High severity
winter: Improper Neutralization of Input During Web Page Generation
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS par
- 8.1 High severity
winter: Improper Neutralization of Input During Web Page Generation
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS
- 8.4 High severity
winter: Protection Mechanism Failure
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit
- 9.9 Critical severity
winter: Improper Access Control
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the rol
- 8.4 High severity
winter: Incomplete List of Disallowed Inputs
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed
- 8.8 High severity
wn-dusk-plugin: Improper Privilege Management
wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS. The Dusk plugin provides some special routes as part of its testing framework to allow a browser environment (such as headless Chrome) to act as a user in t
- 7.2 High severity
winter: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be en
- 9.8 Critical severity
winter: Improperly Controlled Modification of Object Prototype Attributes
Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branc