Directory Traversal

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Directory Traversal via the userfilespath function of the API endpoint /apinosession/thumbnailimg when processing the cachepathrelative argument. An attacker can access o...

CVE-2022-0689

Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0688

Business Logic Errors in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0596

Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0558

Cross-site Scripting XSS - Stored in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0504

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0379

Cross-site Scripting XSS - Stored in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0281

Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0278

Cross-site Scripting XSS - Stored in Packagist microweber/microweber prior to 1.2.11...