CVE Watch10 de nov. de 2026

CVE-2026-125338

Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::

CVSS

4.5

Média

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-79

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The first render after saving custom CSS appears sanitized while priming an unsafe cache entry, and later cache hits return unsanitized output into the backend style element, allowing a user with backend.manage_branding or backend.manage_editor to cause stored cross-site scripting when another backend page renders the styles. The styles also appear on unauthenticated backend sign-in, password restore, and password reset layouts. This issue is fixed in version 1.2.14.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-262488.8 ALT

—

——0A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.3h CVE-2026-1253412.0 BAI

—

——0Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.3h CVE-2026-1253404.5 MÉD

—

——0Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in a crafted top-level GET URL terminates the raw-text template and causes the remaining input to be parsed as backend markup, even when the widget uses searching: false. Any Table or DataTable page is a sink, including the core Editor Settings route /backend/system/settings/update/winter/backend/editor, and an unauthenticated attacker can induce an authorized backend user to follow the link. Script executing in the victim's backend origin can read the CSRF token and issue credentialed requests with that user's permissions. For the core sink, a victim with backend.manage_editor, normally a Developer-role user or superuser, can edit CMS templates, so the injected script can conditionally chain to server-side code execution; this does not grant permissions the victim lacks and does not apply automatically to every third-party plugin sink. This issue is fixed in version 1.2.14.3h CVE-2026-800959.0 CRÍ

—

——0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.4h CVE-2026-1216648.3 ALT

—

——0Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.4h CVE-2026-1199758.8 ALT

—

——0Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.4h