Winter CMS Winter

Winter: Privilege escalation by authenticated backend users

Winter vulnerable to Prototype Pollution in Snowboard framework

Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be entered by a trusted user, such as the owner of the server that hosts Winter CMS, or a developer working for them.

Winter CMS Local File Inclusion through Server Side Template Injection

Winter CMS Stored XSS through Backend ColorPicker FormWidget

Winter CMS vulnerable to stored XSS through privileged upload of SVG file

Stored XSS through privileged upload of Media Manager file followed by renaming

Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager