https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 29 Aug 2026 21:34:14 +0000 https://vulnerability.circl.lu/sighting/e4795816-735e-45a8-8b08-9f710b00ae35/export {"uuid": "e4795816-735e-45a8-8b08-9f710b00ae35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-5CWR-5JXG-PCF6", "type": "seen", "source": "https://gist.github.com/alon710/51fb54a21f3c76c1b91209b9a15704de", "content": "# GHSA-5CWR-5JXG-PCF6: GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-5CWR-5JXG-PCF6\n\n## Summary\nWinter CMS versions prior to 1.2.14 are vulnerable to Stored Cross-Site Scripting (XSS) within the administrative backend interface. The flaw resides in the custom styles rendering pipeline for Brand Settings and Editor Settings. An attacker with privileges to modify backend branding or editor configurations can inject arbitrary JavaScript, which is written to the cache without sanitization. Subsequent page requests that result in a cache hit completely bypass output sanitization filters, leading to JavaScript execution in the sessions of other administrative users.\n\n## TL;DR\nAn incomplete sanitization flow in Winter CMS caches raw, unsanitized custom CSS styles. On cache hits, the raw styles are output directly into the backend interface without sanitization, allowing attackers with branding configuration permissions to achieve administrative privilege escalation via Stored XSS.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Secondary CWE ID**: CWE-524\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.4 (High)\n- **Exploit Status**: PoC / Regression Tested\n- **KEV Status**: Not Listed\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Winter CMS Core Engine (wintercms/winter)\n- **Winter CMS**: < 1.2.14 (Fixed in: `1.2.14`)\n\n## Mitigation\n\n- Upgrade Winter CMS to version 1.2.14 or higher to enforce sanitization on the caching layer.\n- Audit all administrative user roles and ensure that the 'backend.manage_branding' and 'backend.manage_editor' permissions are restricted only to trusted developers.\n- Deploy Web Application Firewall (WAF) rules to inspect backend customization requests for structural HTML elements.\n\n**Remediation Steps:**\n1. Navigate to the project root directory.\n2. Execute 'composer update wintercms/winter' to pull the patched version (v1.2.14).\n3. Flush the application cache to clear any existing poisoned cache entries by running 'php artisan cache:clear'.\n4. Inspect the 'system_settings' table for any anomalous payloads.\n\n## References\n\n- [GitHub Advisory Database GHSA-5CWR-5JXG-PCF6](https://github.com/advisories/GHSA-5CWR-5JXG-PCF6)\n- [Fix Commit on Winter CMS Repository](https://github.com/wintercms/winter/commit/c95d780ab54f3a3f74a94ae1667bf12b3c549d5d)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-5CWR-5JXG-PCF6) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T10:32:44.014379Z"} {"uuid": "e4795816-735e-45a8-8b08-9f710b00ae35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-5CWR-5JXG-PCF6", "type": "seen", "source": "https://gist.github.com/alon710/51fb54a21f3c76c1b91209b9a15704de", "content": "# GHSA-5CWR-5JXG-PCF6: GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-5CWR-5JXG-PCF6\n\n## Summary\nWinter CMS versions prior to 1.2.14 are vulnerable to Stored Cross-Site Scripting (XSS) within the administrative backend interface. The flaw resides in the custom styles rendering pipeline for Brand Settings and Editor Settings. An attacker with privileges to modify backend branding or editor configurations can inject arbitrary JavaScript, which is written to the cache without sanitization. Subsequent page requests that result in a cache hit completely bypass output sanitization filters, leading to JavaScript execution in the sessions of other administrative users.\n\n## TL;DR\nAn incomplete sanitization flow in Winter CMS caches raw, unsanitized custom CSS styles. On cache hits, the raw styles are output directly into the backend interface without sanitization, allowing attackers with branding configuration permissions to achieve administrative privilege escalation via Stored XSS.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Secondary CWE ID**: CWE-524\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.4 (High)\n- **Exploit Status**: PoC / Regression Tested\n- **KEV Status**: Not Listed\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Winter CMS Core Engine (wintercms/winter)\n- **Winter CMS**: < 1.2.14 (Fixed in: `1.2.14`)\n\n## Mitigation\n\n- Upgrade Winter CMS to version 1.2.14 or higher to enforce sanitization on the caching layer.\n- Audit all administrative user roles and ensure that the 'backend.manage_branding' and 'backend.manage_editor' permissions are restricted only to trusted developers.\n- Deploy Web Application Firewall (WAF) rules to inspect backend customization requests for structural HTML elements.\n\n**Remediation Steps:**\n1. Navigate to the project root directory.\n2. Execute 'composer update wintercms/winter' to pull the patched version (v1.2.14).\n3. Flush the application cache to clear any existing poisoned cache entries by running 'php artisan cache:clear'.\n4. Inspect the 'system_settings' table for any anomalous payloads.\n\n## References\n\n- [GitHub Advisory Database GHSA-5CWR-5JXG-PCF6](https://github.com/advisories/GHSA-5CWR-5JXG-PCF6)\n- [Fix Commit on Winter CMS Repository](https://github.com/wintercms/winter/commit/c95d780ab54f3a3f74a94ae1667bf12b3c549d5d)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-5CWR-5JXG-PCF6) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T10:32:44.014379Z"} https://vulnerability.circl.lu/sighting/e4795816-735e-45a8-8b08-9f710b00ae35/export Fri, 21 Aug 2026 10:32:44 +0000