wintercms kayıtları
wintercms üreticisine ait 10 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %90
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4
- CWE-184 Incomplete List of Disallowed Inputs1
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')1
- CWE-284 Improper Access Control1
- CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
10 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
39İzleyin | CVE-2022-39357İstismar yok | Winter vulnerable to Prototype Pollution in Snowboard frameworkwintercms · winter · CWE-1321 | Kritik9,8 | — | %1,1 | 26 Eki 2022 |
39İzleyin | CVE-2026-27591İstismar yok | Winter: Privilege escalation by authenticated backend userswintercms · winter · CWE-284 | Kritik9,9 | — | %0,8 | 11 Mar 2026 |
35İzleyin | CVE-2024-32003İstismar yok | Dusk plugin may allow unfettered user authentication in misconfigured installswintercms · wn-dusk-plugin · CWE-269 | Yüksek8,8 | — | %0,7 | 12 Nis 2024 |
33İzleyin | CVE-2024-54149İstismar yok | Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletionwintercms · winter · CWE-184 | Yüksek8,4 | — | %0,4 | 9 Ara 2024 |
30İzleyin | CVE-2023-52085Kavram kanıtı | Winter CMS Local File Inclusion through Server Side Template Injectionwintercms · winter · CWE-22 | Orta5,4 | — | %30,2 | 28 Ara 2023 |
29İzleyin | CVE-2024-29686İstismar yok | Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted pwintercms · winter · CWE-97 | Yüksek7,2 | — | %1,8 | 29 Mar 2024 |
21İzleyin | CVE-2023-52084İstismar yok | Winter CMS Stored XSS through Backend ColorPicker FormWidgetwintercms · winter · CWE-79 | Orta5,4 | — | %0,3 | 28 Ara 2023 |
20İzleyin | CVE-2023-37269Kavram kanıtı | Winter CMS vulnerable to stored XSS through privileged upload of SVG filewintercms · winter · CWE-79 | Orta4,8 | — | %2,7 | 7 Tem 2023 |
19İzleyin | CVE-2023-52083İstismar yok | Stored XSS through privileged upload of Media Manager file followed by renamingwintercms · winter · CWE-79 | Orta4,8 | — | %0,3 | 28 Ara 2023 |
14İzleyin | CVE-2026-22254İstismar yok | Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Managerwintercms · winter · CWE-79 | Düşük3,5 | — | %0,3 | 6 Şub 2026 |
- CVE-2022-3935739İzleyin
Winter vulnerable to Prototype Pollution in Snowboard framework
KritikCVSS 9,8İstismar yokEPSS %1wintercms · winter26 Eki 2022
- CVE-2026-2759139İzleyin
Winter: Privilege escalation by authenticated backend users
KritikCVSS 9,9İstismar yokEPSS %1wintercms · winter11 Mar 2026
- CVE-2024-3200335İzleyin
Dusk plugin may allow unfettered user authentication in misconfigured installs
YüksekCVSS 8,8İstismar yokEPSS %1wintercms · wn-dusk-plugin12 Nis 2024
- CVE-2024-5414933İzleyin
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
YüksekCVSS 8,4İstismar yokEPSS %0wintercms · winter9 Ara 2024
- CVE-2023-5208530İzleyin
Winter CMS Local File Inclusion through Server Side Template Injection
OrtaCVSS 5,4Kavram kanıtıEPSS %30wintercms · winter28 Ara 2023
- CVE-2024-2968629İzleyin
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted p
YüksekCVSS 7,2İstismar yokEPSS %2wintercms · winter29 Mar 2024
- CVE-2023-5208421İzleyin
Winter CMS Stored XSS through Backend ColorPicker FormWidget
OrtaCVSS 5,4İstismar yokEPSS %0wintercms · winter28 Ara 2023
- CVE-2023-3726920İzleyin
Winter CMS vulnerable to stored XSS through privileged upload of SVG file
OrtaCVSS 4,8Kavram kanıtıEPSS %3wintercms · winter7 Tem 2023
- CVE-2023-5208319İzleyin
Stored XSS through privileged upload of Media Manager file followed by renaming
OrtaCVSS 4,8İstismar yokEPSS %0wintercms · winter28 Ara 2023
- CVE-2026-2225414İzleyin
Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager
DüşükCVSS 3,5İstismar yokEPSS %0wintercms · winter6 Şub 2026