CVE-2020-23139

Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise...

CVE-2020-23136

Microweber v1.1.18 is affected by no session expiry after log-out...

CVE-2020-23139

Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise...

CVE-2020-23136

Microweber v1.1.18 is affected by no session expiry after log-out...

CVE-2020-23138

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension eg- .exe to the web server by providing image data and the image/jpeg content type with a .php extension...

Session fixation

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

Authentication flaw

Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise...

Unrestricted file upload

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension eg- .exe to the web server by providing image data and the image/jpeg content type with a .php extension...

Design/Logic Flaw

Microweber v1.1.18 is affected by no session expiry after log-out...

CVE-2020-23140

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

CVE-2020-23140

CVE-2020-23140 affects Microweber 1.1.18 with insufficient session expiration. According to the connected documents, when a user changes password (and email), the existing sessions on other browsers/devices do not expire and remain active, enabling potential reuse of valid sessions across devices...

CVE-2020-23139

CVE-2020-23139 affects Microweber 1.1.18 and is described across multiple sources as a broken authentication and session management vulnerability that can enable local session hijacking, potentially granting unauthorized access to system data or functionality or leading to complete system comprom...

CVE-2020-23139

Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise...

CVE-2020-23138

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension eg- .exe to the web server by providing image data and the image/jpeg content type with a .php extension...

CVE-2020-23138

Summary (CVE-2020-23138) : Microweber 1.1.18 admin page has an unrestricted file upload vulnerability. An attacker can upload PHP code (or other extensions such as .exe) by providing image data with the image/jpeg content type and a .php extension, enabling remote code execution on the web server...

CVE-2020-23136

Microweber v1.1.18 is affected by insufficient session expiry after logout. The provided sources (GHSA-G7R3-JWHW-2WFV, OSV, RH Red Hat advisory, CNVD entry) corroborate that authenticated users can remain logged in after logout, but no detailed root-cause, affected components, or remediation step...

CVE-2020-23136

Microweber v1.1.18 is affected by no session expiry after log-out...

PT-2020-15544

Name of the Vulnerable Software and Affected Versions Microweber version 1.1.18 Description The issue concerns a problem where there is no session expiry after a user logs out. This could potentially allow unauthorized access to a user's session after they have logged out. Recommendations For...

in microweber/microweber

Description microweber/microweber is vulnerable to Arbitrary File Upload. Effective controls have not been implemented to restrict users from uploading malicious content to the web server. Files containing code like .php, .exe and etc can be uploaded successfully. Steps To Reproduce-: 1. Login in...

Microweber Information Disclosure Vulnerability

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in the userfiles/modules/users/controller/controller.php...