Skip to content
OpenAdvisories

Package · Packagist

winter/wn-backend-module

21 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 2.0
    CVE-2026-125341

    Winter CMS: Stored XSS through Backend List widget image columns

    Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without esca…

    wintercms winter winter/wn-backend-module Packagist
  • Low 2.0
    GHSA-7mpf-4465-7fc2

    Winter: Stored XSS through Backend List widget image columns

    ### Impact `Backend\Widgets\Lists::evalImageTypeValue()` interpolated the resolved image URL into a single-quoted `src` attribute without escaping it. Where a list column of type [`image`](https://wintercms.com/docs/v1.2/docs/backend/lists#image) rendered an …

    winter/wn-backend-module Packagist
  • Low 3.3
    CVE-2023-52085 Scanner template EPSS 30%

    Winter CMS Local File Inclusion through Server Side Template Injection

    Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. Thi…

    wintercms winter winter/wn-backend-module Packagist
  • Low 2.0
    CVE-2023-52084

    Winter CMS Stored XSS through Backend ColorPicker FormWidget

    Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored …

    wintercms winter winter/wn-backend-module Packagist