Skip to content
OpenAdvisories

Vendor

wintercms

18 known vulnerabilities.

Products

winter 17 wn-dusk-plugin 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.0
    CVE-2023-37269 Public exploit

    Winter CMS vulnerable to stored XSS through privileged upload of SVG file

    Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could …

    wintercms winter wintercms/winter Packagist