Microweber Security Vulnerabilities

CVE-2022-0930

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to...

CVE-2022-0929

XSS on dynamic_text module in GitHub repository microweber/microweber prior to...

CVE-2022-0926

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to...

CVE-2022-0921

Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to...

CVE-2022-0928

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to...

CVE-2022-0913

Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to...

CVE-2022-0912

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to...

CVE-2022-0906

Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to...

CVE-2022-0895

Static Code Injection in GitHub repository microweber/microweber prior to...

CVE-2022-0896

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to...

CVE-2022-0855

Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to...

CVE-2022-0777

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to...

CVE-2022-0723

Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to...

CVE-2022-0762

Incorrect Authorization in GitHub repository microweber/microweber prior to...

CVE-2022-0763

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to...

CVE-2022-0724

Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to...

CVE-2022-0721

Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to...

CVE-2022-0719

Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to...

CVE-2022-0688

Business Logic Errors in Packagist microweber/microweber prior to...

CVE-2022-0690

Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to...

CVE-2022-0689

Use multiple time the one-time coupon in Packagist microweber/microweber prior to...

CVE-2022-0678

Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to...

CVE-2022-0666

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to...

CVE-2022-0660

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to...

CVE-2022-0638

Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to...

CVE-2022-0597

Open Redirect in Packagist microweber/microweber prior to...

CVE-2022-0596

Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to...

CVE-2022-0560

Open Redirect in Packagist microweber/microweber prior to...

CVE-2022-0557

OS Command Injection in Packagist microweber/microweber prior to...

CVE-2022-0558

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to...

CVE-2022-0505

Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to...

CVE-2022-0504

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to...

CVE-2022-0506

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to...

CVE-2022-0378

Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to...

CVE-2022-0379

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to...

CVE-2022-0282

Cross-site Scripting in Packagist microweber/microweber prior to...

CVE-2022-0281

Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to...

CVE-2022-0277

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to...

CVE-2022-0278

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to...

CVE-2021-33988

Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting code in the request...

CVE-2020-28337

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously...

CVE-2020-23138

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension (eg- .exe) to the web server by providing image data and the image/jpeg content type with a .php...

CVE-2020-23139

Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system...

CVE-2020-23136

Microweber v1.1.18 is affected by no session expiry after...

CVE-2020-23140

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains...

CVE-2020-13405

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST...

CVE-2020-13241

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image...

CVE-2018-19917

Microweber 1.0.8 has reflected cross-site scripting (XSS)...

CVE-2018-17104

An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via...

CVE-2013-5984

Directory traversal vulnerability in userfiles/modules/admin/backup/delete.php in Microweber before 0.830 allows remote attackers to delete arbitrary files via a .. (dot dot) in the file...