CVE-2020-23139

Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise...

CVE-2020-23140

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

Authentication flaw

Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise...

Session fixation

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

Design/Logic Flaw

Microweber v1.1.18 is affected by no session expiry after log-out...

Unrestricted file upload

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension eg- .exe to the web server by providing image data and the image/jpeg content type with a .php extension...

CVE-2020-23140

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

CVE-2020-23140

CVE-2020-23140 affects Microweber 1.1.18 with insufficient session expiration. According to the connected documents, when a user changes password (and email), the existing sessions on other browsers/devices do not expire and remain active, enabling potential reuse of valid sessions across devices...

CVE-2020-23139

CVE-2020-23139 affects Microweber 1.1.18 and is described across multiple sources as a broken authentication and session management vulnerability that can enable local session hijacking, potentially granting unauthorized access to system data or functionality or leading to complete system comprom...

CVE-2020-23139

Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise...

CVE-2020-23138

Summary (CVE-2020-23138) : Microweber 1.1.18 admin page has an unrestricted file upload vulnerability. An attacker can upload PHP code (or other extensions such as .exe) by providing image data with the image/jpeg content type and a .php extension, enabling remote code execution on the web server...

CVE-2020-23138

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension eg- .exe to the web server by providing image data and the image/jpeg content type with a .php extension...

CVE-2020-23136

Microweber v1.1.18 is affected by no session expiry after log-out...

CVE-2020-23136

Microweber v1.1.18 is affected by insufficient session expiry after logout. The provided sources (GHSA-G7R3-JWHW-2WFV, OSV, RH Red Hat advisory, CNVD entry) corroborate that authenticated users can remain logged in after logout, but no detailed root-cause, affected components, or remediation step...

CVE-2020-23136

Microweber v1.1.18 is affected by no session expiry after log-out...

CVE-2020-23136: Insufficient Session Expiration

Microweber v1.1.18 is affected by no session expiry after log-out...

CVE-2020-23140: Insufficient Session Expiration

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active...

CVE-2020-23138: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension eg- .exe to the web server by providing image data and the image/jpeg content type with a .php extension...

PT-2020-15545

Name of the Vulnerable Software and Affected Versions Microweber version 1.1.18 Description An unrestricted file upload vulnerability was discovered in the Microweber admin account page. An attacker can upload PHP code or any extension e.g., .exe to the web server by providing image data and the...

PT-2020-15544

Name of the Vulnerable Software and Affected Versions Microweber version 1.1.18 Description The issue concerns a problem where there is no session expiry after a user logs out. This could potentially allow unauthorized access to a user's session after they have logged out. Recommendations For...