Composer winter/wn-backend-module has 15 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-52085 | Winter CMS Local File Inclusion through Server Side Template Injection | low | 3.3 | <1.2.4 | 1.2.4 |
| CVE-2026-27591 | Winter vulnerable to privilege escalation by authenticated backend users | critical | 9.9 | >=1.2.0 and <1.2.12 or >=1.1.0 and <1.1.12 or <1.0.477 | 1.2.12, 1.1.12, 1.0.477 |
| CVE-2026-63179 | Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets | medium | 4.9 | <1.2.13 | 1.2.13 |
| CVE-2026-35445 | Winter: Authenticated backend users can bypass Users controller permission checks | high | 0.0 | <1.2.13 | 1.2.13 |
| CVE-2026-32257 | Winter: Stored XSS through Brand Settings custom styles | high | 8.1 | <1.2.13 | 1.2.13 |
| CVE-2026-32258 | Winter: Stored XSS through Editor Settings custom styles | high | 8.1 | >=1.2.10 and <1.2.13 | 1.2.13 |
| CVE-2023-52084 | Winter CMS Stored XSS through Backend ColorPicker FormWidget | low | 2.0 | <1.2.4 | 1.2.4 |
| CVE-2026-32593 | Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax | medium | 5.9 | <1.2.13 | 1.2.13 |
| CVE-2026-54256 | Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata | medium | 5.4 | <1.2.13 | 1.2.13 |
| GHSA-fm29-4mq3-phg6 | Winter: ImportExportController AJAX handlers bypass granular import/export permission gate | high | 8.3 | <1.2.14 | 1.2.14 |
| GHSA-p2ch-c2c3-4xm5 | Winter: CSRF through AJAX handler names reachable as backend page actions | medium | 6.1 | >=1.0.319 and <1.2.14 | 1.2.14 |
| GHSA-5cwr-5jxg-pcf6 | Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles | medium | 4.5 | <1.2.14 | 1.2.14 |
| GHSA-hq84-x37p-j6q5 | Winter: Reflected XSS through the search query parameter in the backend Table widget | medium | 4.5 | >=1.0.420 and <1.2.14 | 1.2.14 |
| GHSA-mpmw-f6h6-3g26 | Winter: My Account preview exposes another backend user's profile by record ID | medium | 4.3 | >=1.2.13 and <1.2.14 | 1.2.14 |
| GHSA-7mpf-4465-7fc2 | Winter: Stored XSS through Backend List widget image columns | low | 2.0 | >=1.1.0 and <1.2.14 | 1.2.14 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked