{"action":"Upgrade winter/wn-backend-module to 1.2.13 or later.","affected":[{"fixed":"1.2.13","introduced":"0"}],"component":"winter/wn-backend-module","cve_ids":["CVE-2026-32593"],"ecosystem":"Packagist","epss":0.00274,"exploited":false,"fixed_versions":["1.2.13"],"ghsa_id":"GHSA-m7jc-g4rc-jmvh","id":"tcs_01M5KF59CF65YV9EX7QWHYQEDC","modified_at":"2026-08-12T14:56:06.567625Z","published_at":"2026-08-12T14:41:13Z","references":["https://osv.dev/vulnerability/GHSA-m7jc-g4rc-jmvh","https://github.com/wintercms/winter/security/advisories/GHSA-m7jc-g4rc-jmvh","https://github.com/wintercms/winter/commit/50713de95adf5298536d93f4d999652525d36d43","https://github.com/wintercms/winter"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-m7jc-g4rc-jmvh","url":"https://osv.dev/vulnerability/GHSA-m7jc-g4rc-jmvh"}],"summary":"Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax"}