Secret information exfiltration by hard coding twitter API keys

Description Secret information used for API calls was embedded in the microweber source code. PoC It's hardcoded in the source code below. - https://github.com/microweber/microweber/blob/master/userfiles/modules/twitterfeed/functions.php php $oauthaccesstoken =...

Cross-Site Scripting (XSS)

microweber/microweber, is vulnerable to Cross-Site Scripting XSS. The vulnerability exits due to a lack of user-input sanitization in DatabaseManager.php which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Microweber Business Logic Errors

More info at https://nvd.nist.gov/vuln/detail/CVE-2023-6566...

Microweber Business Logic Errors

More info at https://nvd.nist.gov/vuln/detail/CVE-2023-6566...

Microweber Cross-site Scripting vulnerability

Microweber 1.3.4 and prior is vulnerable to stored cross-site scripting via an alert on the Editing page. This issue is fixed in commit 42efa981a2239d042d910069952d6276497bdcf1...

GHSA-FQCV-RFP6-WV92 Microweber Cross-site Scripting vulnerability

Microweber 1.3.4 and prior is vulnerable to stored cross-site scripting via an alert on the Editing page. This issue is fixed in commit 42efa981a2239d042d910069952d6276497bdcf1...

CVE-2023-3142

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-3142

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-3142

Summary of CVE-2023-3142 Vulnerability: Cross-site Scripting (XSS) stored in microweber/microweber prior to 2.0, including 1.3.4 and earlier. What’s affected: Microweber web application; the issue is triggered by stored input that is later displayed (notably on the Editing page). Root cause: Stor...

CVE-2023-3142 Cross-site Scripting (XSS) - Stored in microweber/microweber

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...

Microweber 跨站脚本漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber versions prior to 2.0. An...

CVE-2023-3142 Cross-site Scripting (XSS) - Stored in microweber/microweber

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-3142 Cross-site Scripting (XSS) - Stored in microweber/microweber

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...

CVE-2023-3142: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...

Improper Privilege Management

microweber/microweber is vulnerable to Improper Privilege Management . The vulnerability exists due lack of authorization checks in the apiResource parameter of api.php which allows an attacker to provide malicious configuration-related API parameter...

Cross-Site Scripting (XSS)

microweber/microweber is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the template parameter of template.php which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Information Exposure

microweber/microweber, is vulnerable to information exposure. The vulnerability exists in User.php, allowing an attacker to read sensitive information in the system...

Command Injection

microweber/microweber is vulnerable to Command Injection. The vulnerability exists due to improper input sanitization in XSS.php which allows an attacker to inject and execute arbitrary commands through the name field...

Cross-Site Scripting (XSS)

microweber/microweber is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the X-Forwarded-For header, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Microweber Information Disclosure Vulnerability (CNVD-2023-32763)

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. An information disclosure vulnerability exists in Microweber versions prior to 1.3.4,...