1712 matches found
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to cross-site scripting attacks. An attacker is able to inject and execute malicious javascript via bypassing the file upload filter...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to stored cross-site scripting. The vulnerability exists in add/edit tax in microweb due to lack of validations which allows an attacker to inject and execute arbitrary javascript...
Remote Code Execution (RCE)
microweber is vulnerable to remote code execution. The vulnerability exists due a lack of verification of a zip file in the Backup/Restore feature, allowing an attacker to inject maliciously crafted script into the system...
Unrestricted Upload Of File With Dangerous Type
microweber is vulnerable to unrestricted upload of file with dangerous type. The vulnerability exists due to a lack of sanitization of dangerous file type...
Microweber Cross-Site Scripting Vulnerability (CNVD-2022-20797)
Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework. Microweber is vulnerable to a cross-site scripting vulnerability that stems from a file upload filter that fails to properly validate input parameters, which could be exploited to construct a stored XSS,...
Microweber Cross-Site Scripting Vulnerability (CNVD-2022-20688)
Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework. Microweber suffers from a cross-site scripting vulnerability, which can be exploited by attackers to upload . azhtml file e.g. ahtml, bhtml, chtml, ddhtml, as long as it ends in html. After uploading,...
GHSA-3Q55-66G3-P8XQ Cross-site Scripting in microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
Cross-site Scripting in microweber
XSS on dynamictext module in GitHub repository microweber/microweber prior to 1.2.12...
Cross-site Scripting in microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
GHSA-2CV6-6437-39P2 Cross-site Scripting in microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Proof of Concept 1. Go to add post http://site.com/admin/post/create 2. click on create new post 3. There will a option called post title 4. Fill the input field with huge characters, more than 1 lakh 5. Copy the below payload and put it in the input fields and click on continue. 6. You will see...
CVE-2022-0930
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0930
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0930 File upload filter bypass leading to stored XSS in microweber/microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0930
CVE-2022-0930 affects microweber/microweber. The issue is a file upload filter bypass that allows stored XSS via uploaded HTML-like files, reported for versions prior to 1.2.12. The root cause is inadequate validation/filtration of uploads enabling JavaScript execution on access. Remediation per ...
CVE-2022-0930 File upload filter bypass leading to stored XSS in microweber/microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0930
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0929
XSS on dynamictext module in GitHub repository microweber/microweber prior to 1.2.11...
