PT-2022-13390

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.3 Description The issue concerns insecure storage of sensitive information in the microweber/microweber GitHub repository. Specifically, versions prior to 1.3 do not strip images of EXIF data, which ca...

PT-2022-13387

Name of the Vulnerable Software and Affected Versions microweber versions prior to 1.3 Description The issue concerns the insertion of sensitive information into debugging code in the microweber GitHub repository. When the server is run in debug mode, it may expose sensitive information about the...

CVE-2022-0724: Insecure Storage of Sensitive Information

Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3...

CVE-2022-0721: Insertion of Sensitive Information Into Debugging Code

Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3...

CVE-2022-0719: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Reflected in GitHub repository microweber/microweber prior to 1.3...

Microweber 跨站脚本漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber, which originates from the...

PT-2022-13385

Name of the Vulnerable Software and Affected Versions Microweber versions prior to 1.3 Description The issue is related to Cross-site Scripting XSS - Reflected, which occurs when an application includes user input in its responses without properly validating or encoding the input, allowing an...

Microweber CMS 1.2.10 - Local File Inclusion (Authenticated) (Metasploit)

Exploit Title: Microweber CMS v1.2.10 Local File Inclusion Authenticated Date: 22.02.2022 Exploit Author: Talha Karakumru Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber/archive/refs/tags/v1.2.10.zip Version: Microweber CMS v1.2.10 Tested on:...

Microweber 安全漏洞

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. An information disclosure vulnerability exists in versions of Microweber prior to 1.3, which stems from the fact that when...

microweber has an unspecified vulnerability (CNVD-2022-13207)

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A security vulnerability exists in versions of microweber prior to 1.2.11, which stems from a business logic error in the...

microweber cross-site scripting vulnerability (CNVD-2022-13205)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a cross-site scripting vulnerability, and no details of the vulnerability are available at this...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-13204)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a cross-site scripting vulnerability, and no details of the vulnerability are available at this...

microweber has an unspecified vulnerability (CNVD-2022-13203)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a security vulnerability, and no details of the vulnerability are available at this time...

CRLF Injection

microweber/microweber is vulnerable to CRLF Injection. Lack of filtering CRLF characters in redirectUrl allows an attacker to cause stack trace exposure...

Information Disclosure

microweber is vulnerable to information disclosure. Sensitive information are leaked via a 500 error message when a user enters anything in search= parameter as in https://demo.microweber.org/demo/admin/view:modules/loadmodule:commentssearch=...

Business Logic Errors

microweber/microweber is vulnerable to business logic errors. Lack of secure validation of sessionid for usermanager in the function removeitem causes business logic errors...

Cross-site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scripting. An attacker is able to inject malicious script through unsanitized id parameter...

Privilege Escalation

microweber/microweber is vulnerable to privilege escalation. The use of one-time coupon multiple time allows an attacker to manipulate One-Time-Coupon Handler using malicious input...

GHSA-C5GJ-W4HX-GVMX Business Logic Errors in microweber

Microweber prior to 1.2.11 can suffer from insecure direct object references. A malicious actor can remove items from a victim's cart...

Business Logic Errors in microweber

Microweber prior to 1.2.11 can suffer from insecure direct object references. A malicious actor can remove items from a victim's cart...