Vendor
wintercms
18 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
Medium 4.9
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import (inline) directives into LESS sourc…
-
Medium 5.4
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled file_id POST parameter when resolving the attachment it operates on, allowi…
-
Medium 6.8
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS…
-
Medium 5.9
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions k…
-
Medium 4.9
Winter CMS before 1.2.13 Local File Inclusion via JavaScript
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in…