What’s Vulnerable › Products
wintercms winter vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your wintercms winter version is affected
Latest wintercms winter vulnerabilities
- CVE-2026-63179 — Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets (CVSS 4.9)
- CVE-2026-54256 — Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata (CVSS 5.4)
- CVE-2026-32639 — Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads (CVSS 6.8)
- CVE-2026-32593 — Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax (CVSS 5.9)
- CVE-2026-35445 — Winter: Authenticated backend users can bypass Users controller permission checks (CVSS 7.1)
- CVE-2026-32258 — Winter: Stored XSS through Editor Settings custom styles (CVSS 8.1)
- CVE-2026-32257 — Winter: Stored XSS through Brand Settings custom styles (CVSS 8.1)
- CVE-2026-79774 — Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy (CVSS 8.4)
- CVE-2026-79773 — Winter CMS before 1.2.13 Local File Inclusion via JavaScript (CVSS 4.9)
- CVE-2026-27591 — Winter: Privilege escalation by authenticated backend users (CVSS 9.9)
- CVE-2026-22254 — Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager (CVSS 3.5)
- CVE-2024-54149 — Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion (CVSS 8.4)
- CVE-2024-29686 — (CVSS 7.2)
- CVE-2023-52085 — Winter CMS Local File Inclusion through Server Side Template Injection (CVSS 5.4)
- CVE-2023-52084 — Winter CMS Stored XSS through Backend ColorPicker FormWidget (CVSS 5.4)
- CVE-2023-52083 — Stored XSS through privileged upload of Media Manager file followed by renaming (CVSS 4.8)
- CVE-2023-37269 — Winter CMS vulnerable to stored XSS through privileged upload of SVG file (CVSS 4.8)
- CVE-2022-39357 — Winter vulnerable to Prototype Pollution in Snowboard framework (CVSS 9.8)