https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:19:41 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-32257 <p>Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting against backend users. This issue is fixed in version 1.2.13.</p> <p>Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting against backend users. This issue is fixed in version 1.2.13.</p> https://db.gcve.eu/vuln/fkie_cve-2026-32257 https://db.gcve.eu/vuln/ghsa-v7cf-8gh9-gxmj <p><strong>Affected:</strong> Packagist: winter/wn-backend-module</p> <p>### Impact</p> <p>Users with the `backend.manage_branding` (&#34;Customize the back-end&#34;) permission can provide custom CSS through **Settings → Customize Backend → Styles** that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could have allowed a stored XSS attack.</p> <p>Although this is a valid security issue, it&#39;s important to note that its severity is relatively low. To exploit the vulnerability, an attacker would already need to have trusted access to the Winter CMS backend with a specific administrative permission. The Winter CMS maintainers recommend that the `backend.manage_branding` permission only be granted to trusted administrators and developers.</p> <p>A related issue exists in the custom styles field at **Settings → Editor Settings → Markup Styles** (`backend.manage_editor` permission), which uses the same rendering mechanism and is addressed separately.</p> <p>All users are advised to update to the latest version to ensure their systems remain secure.</p> <p>### Patches</p> <p>This issue has been patched in v1.2.13.</p> <p>### Workarounds</p> <p>Apply [https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720](https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720) manually if unable to upgrade to v1.2.13.</p> <p>### Resources</p> <p>- CVE-2025-61676 (identical vulnerability in Octo…</p> <p><strong>Affected:</strong> Packagist: winter/wn-backend-module</p> <p>### Impact</p> <p>Users with the `backend.manage_branding` (&#34;Customize the back-end&#34;) permission can provide custom CSS through **Settings → Customize Backend → Styles** that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could have allowed a stored XSS attack.</p> <p>Although this is a valid security issue, it&#39;s important to note that its severity is relatively low. To exploit the vulnerability, an attacker would already need to have trusted access to the Winter CMS backend with a specific administrative permission. The Winter CMS maintainers recommend that the `backend.manage_branding` permission only be granted to trusted administrators and developers.</p> <p>A related issue exists in the custom styles field at **Settings → Editor Settings → Markup Styles** (`backend.manage_editor` permission), which uses the same rendering mechanism and is addressed separately.</p> <p>All users are advised to update to the latest version to ensure their systems remain secure.</p> <p>### Patches</p> <p>This issue has been patched in v1.2.13.</p> <p>### Workarounds</p> <p>Apply [https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720](https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720) manually if unable to upgrade to v1.2.13.</p> <p>### Resources</p> <p>- CVE-2025-61676 (identical vulnerability in Octo…</p> https://db.gcve.eu/vuln/ghsa-v7cf-8gh9-gxmj