CVE-2022-2495 Cross-site Scripting (XSS) - Stored in microweber/microweber

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.2.21...

CVE-2022-2495

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.2.21...

Microweber 跨站脚本漏洞

Microweber is an online store management system that provides drag-and-drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.2.21, which...

CVE-2022-2470: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Reflected in GitHub repository microweber/microweber prior to 1.2.21...

PT-2022-16811

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.2.21 Description The issue is related to Cross-site Scripting XSS - Reflected. This means an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take...

PT-2022-17006

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.2.21 Description The issue is related to stored Cross-site Scripting XSS, which allows attackers to inject malicious scripts into a website. This can lead to unauthorized access to user data and...

Microweber 跨站脚本漏洞

Microweber is a drag-and-drop online store management system from the US Microweber community. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.2.21. An attacker could use this vulnerability to execute...

CVE-2022-2495: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.2.21...

The vulnerability of the Microweber content management system arises from the lack of measures taken to protect the website structure, allowing attackers to carry out XSS attacks.

The vulnerability of the Microweber content management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2021-36461

An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...

CVE-2021-36461

An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...

Privilege escalation

An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...

CVE-2021-36461

An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...

CVE-2021-36461

CVE-2021-36461 is an arbitrary file upload vulnerability in Microweber 1.1.3. An attacker can upload a malicious image through the Settings Upload Picture option (using user.ini) to achieve shell access. Affected component: Microweber web application; vulnerability type: arbitrary file upload; im...

CVE-2021-36461

An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...

CVE-2021-36461: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...

PT-2022-10516

Name of the Vulnerable Software and Affected Versions Microweber version 1.1.3 Description An Arbitrary File Upload issue exists, allowing attackers to upload pictures with malicious code, such as user.ini, via the Settings Upload Picture section, potentially leading to unauthorized access...

Microweber 代码问题漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A code issue vulnerability exists in Microweber 1.1.3, which can be exploited by an...

Business Logic Errors

microweber/microweber is vulnerable to business logic errors. The vulnerability exists in the login function of UserManager.php due to lack of validations in user headers which allows a malicious attacker to bypass IP detection and perform brute-force attacks...

GHSA-9WQR-9787-P4RF Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password

In the login API, an IP address will by default be blocked when the user tries to login incorrectly more than 5 times. However, a bypass to this mechanism is possible by abusing a X-Forwarded-For header to bypass IP detection and perform a password brute-force. A patch for this issue is available...