105 matches found
CVE-2026-65693
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
EUVD-2026-48665
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
PT-2026-64371
Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21 Description Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates. This occurs because the Twig environment in the TwigView::render...
CVE-2026-65694
Microweber CMS up to version 2.0.20 is affected by a path traversal in the static file controller. The vulnerability allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter, exploiting normalize_path() failure to strip...
Cross-site Scripting (XSS)
Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the relid parameter in the /admin/category/create endpoint. An attacker can execute arbitrary JavaScript code in the context of an...
Cross-site Scripting (XSS)
Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the orderDirection parameter in the /admin/order/abandoned endpoint. An attacker can execute arbitrary JavaScript code in the context of an...
CVE-2025-60954
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts...
Microweber CMS 安全漏洞
Microweber CMS is a drag-and-drop website builder from Microweber Open Source. A security vulnerability exists in version 2.0 of Microweber CMS, which stems from lax password requirements and could lead to account cracking...
Weak Password Requirements
Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Weak Password Requirements in the password reset process. An attacker can gain unauthorized access to user or administrative accounts using weak passwords that are easily...
PT-2025-43670
Name of the Vulnerable Software and Affected Versions Microweber CMS version 2.0 Description The application does not enforce minimum password length or complexity during password resets. This allows users to set weak passwords, including single-character passwords, potentially leading to account...
EUVD-2014-9283
Malware in sbrugna...
EUVD-2021-2263
Malware in sbrugna...
EUVD-2025-23377
Malicious code in bioql PyPI...
EUVD-2025-23376
Malicious code in bioql PyPI...
EUVD-2025-19754
Malicious code in bioql PyPI...
EUVD-2025-23298
Malicious code in bioql PyPI...