1428 matches found
Microweber Cross-Site Scripting Vulnerability (CNVD-2022-13204)
Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a cross-site scripting vulnerability, and no details of the vulnerability are available at this...
microweber has an unspecified vulnerability (CNVD-2022-13207)
Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A security vulnerability exists in versions of microweber prior to 1.2.11, which stems from a business logic error in the...
CRLF Injection
microweber/microweber is vulnerable to CRLF Injection. Lack of filtering CRLF characters in redirectUrl allows an attacker to cause stack trace exposure...
Information Disclosure
microweber is vulnerable to information disclosure. Sensitive information are leaked via a 500 error message when a user enters anything in search= parameter as in https://demo.microweber.org/demo/admin/view:modules/loadmodule:commentssearch=...
Business Logic Errors
microweber/microweber is vulnerable to business logic errors. Lack of secure validation of sessionid for usermanager in the function removeitem causes business logic errors...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to cross-site scripting. An attacker is able to inject malicious script through unsanitized id parameter...
Privilege Escalation
microweber/microweber is vulnerable to privilege escalation. The use of one-time coupon multiple time allows an attacker to manipulate One-Time-Coupon Handler using malicious input...
Business Logic Errors in microweber
Microweber prior to 1.2.11 can suffer from insecure direct object references. A malicious actor can remove items from a victim's cart...
GHSA-C5GJ-W4HX-GVMX Business Logic Errors in microweber
Microweber prior to 1.2.11 can suffer from insecure direct object references. A malicious actor can remove items from a victim's cart...
Microweber 1.2.11 Shell Upload
Exploit Title: Microweber 1.2.11 - Remote Code Execution RCE Authenticated Google Dork: NA Date: 02/17/2022 Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber Version: 1.2.11 Tested on: KALI OS CVE :...
Microweber 1.2.11 - Remote Code Execution (Authenticated) Vulnerability
Exploit Title: Microweber 1.2.11 - Remote Code Execution RCE Authenticated Google Dork: NA Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber Version: 1.2.11 Tested on: KALI OS CVE : CVE-2022-0557...
Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
Exploit Title: Microweber 1.2.11 - Remote Code Execution RCE Authenticated Google Dork: NA Date: 02/17/2022 Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber Version: 1.2.11 Tested on: KALI OS CVE :...
CVE-2022-0688
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11...
CVE-2022-0688
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11...
Code injection
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11...
CVE-2022-0688
CVE-2022-0688 affects microweber/microweber prior to 1.2.11. The Red Hat OSV/GHSA entries and related records describe a business logic/ insecure direct object reference issue in Microweber that can enable a malicious actor to manipulate cart contents (e.g., removing items) without proper authori...
CVE-2022-0688 Business Logic Errors in microweber/microweber
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11...
CVE-2022-0688 Business Logic Errors in microweber/microweber
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11...