CVE-2020-23139: Improper Authentication

Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise...

PT-2020-15548

Name of the Vulnerable Software and Affected Versions Microweber version 1.1.18 Description The issue concerns insufficient session expiration. When a user changes their password, both the session for the email change and old sessions on other browsers or devices remain active and do not expire...

PT-2020-15546

Name of the Vulnerable Software and Affected Versions Microweber version 1.1.18 Description The issue concerns broken authentication and session management, which may lead to local session hijacking. This could result in unauthorized access to system data or functionality, or a complete system...

in microweber/microweber

Description microweber/microweber is vulnerable to Arbitrary File Upload. Effective controls have not been implemented to restrict users from uploading malicious content to the web server. Files containing code like .php, .exe and etc can be uploaded successfully. Steps To Reproduce-: 1. Login in...

Microweber Information Disclosure Vulnerability

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in the userfiles/modules/users/controller/controller.php...

CVE-2020-13405

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...

CVE-2020-13405

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...

Cross site request forgery (csrf)

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...

CVE-2020-13405

Microweber

CVE-2020-13405

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...

CVE-2020-13405

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...

PT-2020-13522

Name of the Vulnerable Software and Affected Versions Microweber versions prior to 1.1.20 Description The issue allows an unauthenticated user to disclose the users database via a "/modules/ POST" request. This is possible due to a flaw in the userfiles/modules/users/controller/controller.php fil...

CVE-2020-13405: Missing Authentication for Critical Function

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...

CVE-2020-13405: MicroWeber Unauthenticated User Database Disclosure

The post CVE-2020-13405: MicroWeber Unauthenticated User Database Disclosure appeared first on Rhino Security Labs...

Microweber Code Issue Vulnerability

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A code issue vulnerability exists in admin/view:modules/loadmodule:usersedit-user=1 in...

CVE-2020-13241

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...

CVE-2020-13241

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...

Unrestricted file upload

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...

CVE-2020-13241

CVE-2020-13241 affects Microweber 1.1.18. The issue is an uncontrolled/unrestricted file upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the added file’s extension corresponds to an image file. This can enable upload of non-image files via the Add Image option...

CVE-2020-13241

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...