Security
فارسی
All products

winter/wn-backend-module

Composer · Package
15 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Winter: ImportExportController AJAX handlers bypass granular import/export permission gateCVE-2026-125337 · GHSA-FM29-4MQ3-PHG6 winter/wn-backend-module Composer High Fix reported
Winter: Reflected XSS through the search query parameter in the backend Table widgetCVE-2026-125340 · GHSA-HQ84-X37P-J6Q5 winter/wn-backend-module Composer Medium Fix reported
Winter: CSRF through AJAX handler names reachable as backend page actionsCVE-2026-125339 · GHSA-P2CH-C2C3-4XM5 winter/wn-backend-module Composer Medium Fix reported
Winter: Stored XSS through cached Brand Settings and Editor Settings custom stylesCVE-2026-125338 · GHSA-5CWR-5JXG-PCF6 winter/wn-backend-module Composer Medium Fix reported
Winter: My Account preview exposes another backend user's profile by record IDCVE-2026-126061 · GHSA-MPMW-F6H6-3G26 winter/wn-backend-module Composer Medium Fix reported
Winter: Stored XSS through Backend List widget image columnsCVE-2026-125341 · GHSA-7MPF-4465-7FC2 winter/wn-backend-module Composer Low Fix reported
Winter CMS Local File Inclusion through Server Side Template Injection CVE-2023-52085 · GHSA-2X7R-93WW-CXRQ winter/wn-backend-module Composer Low Fix reported
Winter CMS Stored XSS through Backend ColorPicker FormWidgetCVE-2023-52084 · GHSA-43W4-4J3C-JX29 winter/wn-backend-module Composer Low Fix reported
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assetsCVE-2026-63179 · GHSA-58FP-MCX6-7QF9 winter/wn-backend-module Composer Medium Fix reported
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadataCVE-2026-54256 · GHSA-3277-H8G9-QJ5F winter/wn-backend-module Composer Medium Fix reported
Winter: Authenticated backend users can bypass Users controller permission checksCVE-2026-35445 · GHSA-J5JQ-CR68-V2XX winter/wn-backend-module Composer High Fix reported
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjaxCVE-2026-32593 · GHSA-M7JC-G4RC-JMVH winter/wn-backend-module Composer Medium Fix reported
Winter: Stored XSS through Editor Settings custom stylesCVE-2026-32258 · GHSA-VGP4-2FC4-QFF2 winter/wn-backend-module Composer High Fix reported
Winter: Stored XSS through Brand Settings custom stylesCVE-2026-32257 · GHSA-V7CF-8GH9-GXMJ winter/wn-backend-module Composer High Fix reported
Winter vulnerable to privilege escalation by authenticated backend usersCVE-2026-27591 · GHSA-PGPF-M8M4-6CG6 winter/wn-backend-module Composer Critical Fix reported