cve.bz

wintercms winter vulnerabilities in 2023, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 5.4CVE-2023-52085ExploitEPSS 30%

    Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom style…

  2. 5.4CVE-2023-52084EPSS 0.3%

    Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially al…

  3. 4.8CVE-2023-52083EPSS 0.3%

    Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanit…

  4. 4.8CVE-2023-37269ExploitEPSS 2.7%

    Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not san…