Nrawwad

Stored cross-site scripting occurs because the `renderCss()` functions in `BrandSetting` and `EditorSetting` store raw LESS compiler output using `Cache::forever()`. The `strip tags()` function is only applied to values returned during a cache miss. Consequently, while the initial render after saving custom CSS appears sanitized, an unsafe entry is created in the cache. Subsequent cache hits return unsanitized output into the backend style element. This allows users with `backend.manage branding` or `backend.manage editor` permissions to execute scripts when backend pages, including unauthenticated sign-in, password restore, and password reset layouts, render the styles.

An issue exists where the `BackendClassesController::actionExists()` function accepts public handler-shaped methods as page actions. This allows a top-level GET request to invoke state-changing backend AJAX handlers without a CSRF (Cross-Site Request Forgery) token. Because backend routes use `Route::any` and CSRF validation is skipped for GET requests, an unauthenticated attacker can induce an authorized backend user to follow a malicious link. This can lead to destructive actions such as truncating logs, resetting settings, altering backend user state, or deleting CMS templates. The attacker can also select target records via URL path segments. The default `SameSite=Lax` session cookie facilitates this by being sent during cross-site navigation.

Winter CMS fails to HTML-encode the `search` query parameter within the backend Table widget partial located at `modules/backend/widgets/table/partials/ table.php`. Because this value is emitted inside a `<script type="text/template">` block, an attacker can use a script-closing sequence in a crafted GET URL to terminate the template and inject arbitrary backend markup. This issue affects any page rendering a Table or DataTable widget, including the core Editor Settings endpoint `/backend/system/settings/update/winter/backend/editor`. An unauthenticated attacker can induce an authorized backend user to follow a malicious link, executing scripts in the victim's authenticated backend origin. This allows the attacker to read the CSRF token and perform credentialed requests. For users with `backend.manage editor` permissions, such as those with the Developer role or superusers, this can lead to server-side code execution by editing CMS templates.

An authenticated backend user can cause unauthorized disclosure of other backend user profile data. The `BackendControllersMyAccount` controller inherits actions from `FormController` while declaring an empty `$requiredPermissions` array, and the `formFindModelObject()` function resolves record identifiers through an unscoped `BackendModelsUser` query. This allows an attacker to request sequential user identifiers via the `/backend/backend/myaccount/preview/{other user id}` endpoint or the inherited update action to read sensitive information, including name, login, email, avatar, role, group membership, superuser status, and throttle state. Password material is not exposed, and cross-user writes are blocked by authorization guards.