CVE-2023-52085 Scanner
Detects 'Local File Inclusion (LFI)' vulnerability in Winter CMS affects v. before 1.2.4.
Used 3k times · 3.3k assets checked · domain, ipv4, subdomain
CVE
CVE-2023-52085
5.4
CVSSlow
Exploitable remotely over the internet · requires high privileges.
Description
Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.
Attack Vector
Network
Privileges Req.
High
User Interaction
None
winter
Updated Sep 28, 2026View on NVD →
S4E scanner
CVE history: winter
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →