Advisories for packages from winter

Listing reported advisories for packages from winter sorted by their report date.

Winter vulnerable to privilege escalation by authenticated backend users
GitHub

winter/wn-backend-module

>= 1.2.0, < 1.2.12 · >= 1.1.0, < 1.1.12 · < 1.0.477

2026-03-12 14:07:39
Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager
GitHub

winter/wn-cms-module

<= 1.2.9

2026-02-04 21:32:40
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
GitHub

winter/wn-cms-module

>= 1.1.0, < 1.1.11 · >= 1.2.0, < 1.2.7 · < 1.0.476

2024-12-09 20:41:42
Dusk plugin may allow unfettered user authentication in misconfigured installs
GitHub

winter/wn-dusk-plugin

< 2.1.0

2024-04-12 21:26:02
Winter CMS Local File Inclusion through Server Side Template Injection
GitHub

winter/wn-backend-module

< 1.2.4

2024-01-02 14:10:27
Winter CMS Stored XSS through Backend ColorPicker FormWidget
GitHub

winter/wn-backend-module

< 1.2.4

2023-12-28 22:32:52
Winter CMS Stored XSS through privileged upload of Media Manager file followed by renaming
GitHub

winter/wn-system-module

< 1.2.4

2023-12-28 22:32:11

Need help?

We are happy to help you with any questions you might have.

Documentation Roadmap Report a bug Get in touch