- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9 · 1 critical, 3 high, 3 medium, 2 low
- Registry
- Packagist
Advisories 9
- CVE-2026-63179Medium 4.9
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Affected: fixed in 1.2.13.
- CVE-2026-54256Medium 5.4
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Affected: fixed in 1.2.13.
- CVE-2026-32593Medium 5.9
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Affected: fixed in 1.2.13.
- CVE-2026-32258High 8.1
Winter: Stored XSS through Editor Settings custom styles
Affected: from 1.2.10, fixed in 1.2.13.
- CVE-2026-32257High 8.1
Winter: Stored XSS through Brand Settings custom styles
Affected: fixed in 1.2.13.
- CVE-2026-35445High 7.1
Winter: Authenticated backend users can bypass Users controller permission checks
Affected: fixed in 1.2.13.
- CVE-2026-27591Critical 10.0
Winter: Privilege escalation by authenticated backend users
Affected: from 1.2.0, fixed in 1.2.12; from 1.1.0, fixed in 1.1.12; fixed in 1.0.477.
- CVE-2023-52085Low 3.3
Winter CMS Local File Inclusion through Server Side Template Injection
Affected: fixed in 1.2.4.
- CVE-2023-52084Low 2.0
Winter CMS Stored XSS through Backend ColorPicker FormWidget
Affected: fixed in 1.2.4.