https://vulnerability.circl.lu/sightings/feed 2026-08-23T20:32:57.006154+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7e3ddad7-2bb3-40d4-bcfd-cb0d99a2edca/export 2026-08-23T20:32:57.012312+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7e3ddad7-2bb3-40d4-bcfd-cb0d99a2edca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7mpf-4465-7fc2", "type": "seen", "source": "https://gist.github.com/alon710/e698539f8539d91595e3fc297e68257c", "content": "# GHSA-7MPF-4465-7FC2: GHSA-7mpf-4465-7fc2: Stored Cross-Site Scripting in Winter CMS Backend List Widget\n\n> **CVSS Score:** 2.0\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-7MPF-4465-7FC2\n\n## Summary\nA Stored Cross-Site Scripting (XSS) vulnerability exists in the Backend List widget of Winter CMS (winter/wn-backend-module). When a list column is configured with the 'image' type and displays attacker-controlled input, the lack of sanitization in the image URL allows injection of arbitrary HTML attributes, potentially executing malicious scripts in the session of administrators viewing the list.\n\n## TL;DR\nUnescaped HTML attribute interpolation in Winter CMS Backend List image columns allows stored XSS via crafted image URLs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 2.0 (Low)\n- **Impact**: Low (Integrity Loss only)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Winter CMS Backend Module\n- **winter/wn-backend-module**: >= 1.1.0, < 1.2.14 (Fixed in: `1.2.14`)\n\n## Mitigation\n\n- Upgrade winter/wn-backend-module to 1.2.14 or later.\n- Manually apply contextual HTML escaping using the e() helper function inside Lists.php.\n\n**Remediation Steps:**\n1. Execute `composer update winter/wn-backend-module` within the project root directory.\n2. Verify that the file `modules/backend/widgets/Lists.php` uses `e($imageUrl)` when rendering list columns of type `image`.\n3. Audit stored values in columns linked to backend image lists for malicious event handlers or single quote breakouts.\n\n## References\n\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-7mpf-4465-7fc2)\n- [Winter CMS Security Advisory](https://github.com/wintercms/winter/security/advisories/GHSA-7mpf-4465-7fc2)\n- [Fix Commit](https://github.com/wintercms/winter/commit/0941c9816181095fe35d58e78e6d0c4a49238967)\n- [Winter CMS v1.2.14 Release Notes](https://github.com/wintercms/winter/releases/tag/v1.2.14)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7MPF-4465-7FC2) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T13:31:39.509107Z"} 2026-08-21T13:31:39.509107+00:00