11 results · Clear filters · Feed
-
Medium 4.3
Winter: My Account preview exposes another backend user's profile by record ID
Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions …
-
Medium 4.5
Winter: Reflected XSS through the search query parameter in the backend Table widget
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script …
-
Medium 6.1
Winter CMS: CSRF through AJAX handler names reachable as backend page actions
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing bac…
-
Medium 4.5
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a…
-
Medium 4.9
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import (inline) directives into LESS sourc…
-
Medium 5.4
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled file_id POST parameter when resolving the attachment it operates on, allowi…
-
Medium 5.9
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions k…
-
Medium 4.5
Winter: Reflected XSS through the search query parameter in the backend Table widget
### Impact Affected versions of Winter CMS render the `search` query parameter without HTML encoding inside a `<script type="text/template">` block in the backend Table widget partial (`modules/backend/widgets/table/partials/_table.php`): ```php value="<?= ge…
-
Medium 6.1
Winter: CSRF through AJAX handler names reachable as backend page actions
### Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level `GET` navigation with no CSRF token. `Backend\Classes\Controller::actionExists()` accepted any public method on a controller as a page action, so handle…
-
Medium 4.5
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
### Impact Users with the `backend.manage_branding` ("Customize the back-end") or `backend.manage_editor` ("Manage global code editor preferences") permission can provide custom CSS through **Settings → Customize Backend → Styles** or **Settings → Editor Sett…
-
Medium 4.3
Winter: My Account preview exposes another backend user's profile by record ID
### Impact `Backend\Controllers\MyAccount`, introduced in v1.2.13, declares an empty `$requiredPermissions` array so that any authenticated backend user can manage their own account. It implements the `FormController` behavior, which exposes three routable ac…