CVE-2024-33298

Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=adminbackup...

CVE-2023-5861

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-5318

Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-6599

Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-2239

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4...

CVE-2023-2240

Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4...

CVE-2023-2014

Cross-site Scripting XSS - Generic in GitHub repository microweber/microweber prior to 1.3.3...

CVE-2023-1877

Command Injection in GitHub repository microweber/microweber prior to 1.3.3...

CVE-2023-1081

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.3.3...

CVE-2023-0608

Cross-site Scripting XSS - DOM in GitHub repository microweber/microweber prior to 1.3.2...

CVE-2023-1881

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.3.3...

CVE-2023-3142

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-5976

Improper Access Control in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-6832

Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-47379

Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting XSS via the profile picture file upload functionality...

CVE-2023-48122

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method...

CVE-2022-1439

Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction...

CVE-2022-2252

Open Redirect in GitHub repository microweber/microweber prior to 1.2.19...

CVE-2022-2368

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20...

CVE-2022-4647

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.3.2...