winter/wn-backend-module vulnerabilities (Packagist)
15 vulnerabilities.
-
winter/wn-backend-modulePackagist Winter: Reflected XSS through the search query parameter in the backend Table widget 4.5 Medium -
winter/wn-backend-modulePackagist Winter: CSRF through AJAX handler names reachable as backend page actions 6.1 Medium -
winter/wn-backend-modulePackagist Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles 4.5 Medium -
winter/wn-backend-modulePackagist Winter: ImportExportController AJAX handlers bypass granular import/export permission gate 8.3 High -
winter/wn-backend-modulePackagist Winter: My Account preview exposes another backend user's profile by record ID 4.3 Medium -
winter/wn-backend-modulePackagist Winter: Stored XSS through Backend List widget image columns 2.0 Low -
winter/wn-backend-modulePackagist Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets 4.9 Medium -
winter/wn-backend-modulePackagist Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata 5.4 Medium -
winter/wn-backend-modulePackagist Winter: Authenticated backend users can bypass Users controller permission checks 7.1 High -
winter/wn-backend-modulePackagist Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax 5.9 Medium -
winter/wn-backend-modulePackagist Winter: Stored XSS through Editor Settings custom styles 8.1 High -
winter/wn-backend-modulePackagist Winter: Stored XSS through Brand Settings custom styles 8.1 High -
winter/wn-backend-modulePackagist Winter: Privilege escalation by authenticated backend users 10.0 Critical -
winter/wn-backend-modulePackagist Winter CMS Local File Inclusion through Server Side Template Injection 3.3 Low -
winter/wn-backend-modulePackagist Winter CMS Stored XSS through Backend ColorPicker FormWidget 2.0 Low