Everythingblackkk

**Name of the Vulnerable Software and Affected Versions** Winter CMS versions prior to 1.2.13 **Description** An issue exists where the backend fails to validate the handler name submitted via the ` handler` POST field during form postbacks. While AJAX requests are validated against the `on[A-Z][w+]*` pattern, the postback path passes the ` handler` value directly to the handler dispatcher without validation. This allows an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones, provided the controller has a public action or relaxes its `$requiredPermissions` check. For instance, the Users controller set `$requiredPermissions` to `null` for the `myaccount` action, enabling users without the `backend.manage users` permission to call sensitive methods such as `update onDelete` and `update onManualPasswordReset()`. **Recommendations** Update Winter CMS to version 1.2.13 or later. As a temporary workaround, validate the ` handler` POST field against the `on[A-Z][w+]*` pattern in `modules/backend/classes/Controller.php` before it is passed to `runAjaxHandler()`. As a temporary workaround, remove the conditional that sets `$requiredPermissions` to `null` for the `myaccount` action in `modules/backend/controllers/Users.php`.

**Name of the Vulnerable Software and Affected Versions** Statamic versions prior to 5.73.14 Statamic versions prior to 6.7.0 **Description** Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. The vulnerable endpoint is `/cp/field/action`. The issue involves manipulating field definitions to bypass authorization controls. **Recommendations** Update to Statamic version 5.73.14 or later. Update to Statamic version 6.7.0 or later.