CVE-2022-0282 Cross-site Scripting in microweber/microweber

Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0282 Cross-site Scripting in microweber/microweber

Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11...

Information disclosure

Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0281 Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber

Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0278

Cross-site Scripting XSS - Stored in Packagist microweber/microweber prior to 1.2.11...

Cross site scripting

Cross-site Scripting XSS - Stored in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0278

CVE-2022-0278 is a stored XSS vulnerability in microweber/microweber (Packagist) prior to version 1.2.11. The issue arises from insufficient input validation/output handling, enabling attacker-supplied data to execute JavaScript in a victim’s browser. Multiple sources corroborate the description ...

CVE-2022-0278 Cross-site Scripting (XSS) - Stored in microweber/microweber

Cross-site Scripting XSS - Stored in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0277 Incorrect Permission Assignment for Critical Resource in microweber/microweber

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11...

Cross-Site Request Forgery (CSRF) in microweber/microweber

Description Hello Microweber team I found a CSRF on deleting the comments : //PoC.html history.pushState'', '', '/' after you run this PoC.html you can see that the comment with id 1 will be deleted...

Cross-Site Request Forgery (CSRF) in microweber/microweber

✍️ Description Attacker able to delete any user if knows the user id parameter value. 🕵️‍♂️ Proof of Concept Here after running PoC.html and you will see that the user with id 3 has been deleted. //PoC.html history.pushState'', '', '/' document.forms0.submit; 💥 Impact Here a user with id value 3...