Microweber Cross-Site Scripting Vulnerability (CNVD-2022-20515)

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.2.11. The vulnerability stems from a lack of data validation filtering of user-supplied and output data in the template name, template type, sender name, sender email, and theme parameters. An attacker could use the vulnerability to execute JavaScript code on the client side to steal their cookies to compromise the user.