wintercms winter vulnerabilities in 2024, newest first
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 8.4CVE-2024-54149EPSS 0.4%
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypas…
- 7.2CVE-2024-29686EPSS 1.8%
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the pay…