The vulnerability resides in Winter CMS’s backend Filter widget, in the numberrange scope type when it is configured with a conditions key. When a list view applies this scope, the widget interpolates filter values directly into a SQL conditions statement without using parameter binding. An authenticated backend user can supply crafted input through the AJAX handler that feeds the filter, causing the database to execute arbitrary SQL and read data. The description makes clear that the issue is an injection flaw that can expose database contents to users with backend access.

Winter CMS versions up to and including 1.2.12 are affected. The flaw only manifests when a third‑party plugin has registered a numberrange filter scope with a conditions key; a vanilla installation that does not include such a plugin is not impacted. The fix is present in version 1.2.13 and newer.

The CVSS score of 5.9 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated backend account and the presence of a specific plugin configuration, reducing the likelihood of widespread attacks. Nevertheless, within environments that meet these conditions, an attacker could read sensitive data from the database. Monitoring for unauthorized backend access and plugin misuse is therefore recommended.