Vulnerabilities in wintercms
24 resultsCVE-2026-32593MEDIUMWinter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjaxEPSS 0.3%CVE-2026-126061MEDIUMWinter CMS: My Account preview exposes another backend user's profile by record IDEPSS 0.3%CVE-2026-54256MEDIUMWinter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadataEPSS 0.2%CVE-2026-125339MEDIUMWinter CMS: CSRF through AJAX handler names reachable as backend page actionsEPSS 0.2%