CVE-2022-0719

CVE-2022-0719 affects Microweber (microweber/microweber) prior to version 1.3. It is a reflected cross-site scripting (XSS) vulnerability caused by unvalidated input in the content admin flow, enabling execution of client-side code. Practical impact described across sources includes potential coo...

CVE-2022-0719 Cross-site Scripting (XSS) - Reflected in microweber/microweber

Cross-site Scripting XSS - Reflected in GitHub repository microweber/microweber prior to 1.3...

Microweber 安全漏洞

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. An information disclosure vulnerability exists in versions of Microweber prior to 1.3, which stems from the fact that when...

microweber 安全漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in microweber versions prior to 1.3, which stems from th...

Microweber 跨站脚本漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber, which originates from the...

Microweber CMS 1.2.10 Local File Inclusion Exploit

Exploit Title: Microweber CMS v1.2.10 Local File Inclusion Authenticated Exploit Author: Talha Karakumru Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber/archive/refs/tags/v1.2.10.zip Version: Microweber CMS v1.2.10 Tested on: Microweber CMS v1.2.10...

Microweber CMS 1.2.10 Local File Inclusion

Exploit Title: Microweber CMS v1.2.10 Local File Inclusion Authenticated Date: 22.02.2022 Exploit Author: Talha Karakumru Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber/archive/refs/tags/v1.2.10.zip Version: Microweber CMS v1.2.10 Tested on:...

Microweber CMS 1.2.10 - Local File Inclusion (Authenticated) (Metasploit)

Exploit Title: Microweber CMS v1.2.10 Local File Inclusion Authenticated Date: 22.02.2022 Exploit Author: Talha Karakumru Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber/archive/refs/tags/v1.2.10.zip Version: Microweber CMS v1.2.10 Tested on:...

microweber cross-site scripting vulnerability (CNVD-2022-13205)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a cross-site scripting vulnerability, and no details of the vulnerability are available at this...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-13204)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a cross-site scripting vulnerability, and no details of the vulnerability are available at this...

microweber has an unspecified vulnerability (CNVD-2022-13203)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a security vulnerability, and no details of the vulnerability are available at this time...

microweber has an unspecified vulnerability (CNVD-2022-13207)

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A security vulnerability exists in versions of microweber prior to 1.2.11, which stems from a business logic error in the...

CRLF Injection

microweber/microweber is vulnerable to CRLF Injection. Lack of filtering CRLF characters in redirectUrl allows an attacker to cause stack trace exposure...

Information Disclosure

microweber is vulnerable to information disclosure. Sensitive information are leaked via a 500 error message when a user enters anything in search= parameter as in https://demo.microweber.org/demo/admin/view:modules/loadmodule:commentssearch=...

Business Logic Errors

microweber/microweber is vulnerable to business logic errors. Lack of secure validation of sessionid for usermanager in the function removeitem causes business logic errors...

Cross-site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scripting. An attacker is able to inject malicious script through unsanitized id parameter...

Privilege Escalation

microweber/microweber is vulnerable to privilege escalation. The use of one-time coupon multiple time allows an attacker to manipulate One-Time-Coupon Handler using malicious input...

Business Logic Errors in microweber

Microweber prior to 1.2.11 can suffer from insecure direct object references. A malicious actor can remove items from a victim's cart...

GHSA-C5GJ-W4HX-GVMX Business Logic Errors in microweber

Microweber prior to 1.2.11 can suffer from insecure direct object references. A malicious actor can remove items from a victim's cart...

Microweber 1.2.11 Shell Upload

Exploit Title: Microweber 1.2.11 - Remote Code Execution RCE Authenticated Google Dork: NA Date: 02/17/2022 Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber Version: 1.2.11 Tested on: KALI OS CVE :...