Skip to content
OpenAdvisories

Package · Packagist

winter/wn-cms-module

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.8
    CVE-2026-32639

    Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

    Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS…

    wintercms winter winter/wn-cms-module Packagist