CVE-2022-2130

CVE-2022-2130 is a reflected XSS in Microweber CMS prior to 1.2.17. Multiple connected sources (Nuclei template, CNVD/CW, OSV, and CVE aggregations) describe a vulnerability in Microweber ≤1.2.16 where the /demo/editor_tools/module endpoint accepts a type parameter that may be reflected in the br...

CVE-2022-2130 Cross-site Scripting (XSS) - Reflected in microweber/microweber

Cross-site Scripting XSS - Reflected in GitHub repository microweber/microweber prior to 1.2.17...

Microweber 跨站脚本漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber versions prior to 1.2.17, whic...

Microweber CMS 1.2.15 Account Takeover

Exploit Title: Microweber CMS 1.2.15 - Account Takeover Date: 2022-05-09 Exploit Author: Manojkumar J Vendor Homepage: https://github.com/microweber/microweber Software Link: https://github.com/microweber/microweber/releases/tag/v1.2.15 Version: =1.2.15 Tested on: Windows10 CVE : CVE-2022-1631...

Microweber CMS 1.2.15 - Account Takeover Vulnerability

Exploit Title: Microweber CMS 1.2.15 - Account Takeover Exploit Author: Manojkumar J Vendor Homepage: https://github.com/microweber/microweber Software Link: https://github.com/microweber/microweber/releases/tag/v1.2.15 Version: =1.2.15 Tested on: Windows10 CVE : CVE-2022-1631 Description:...

Microweber CMS 1.2.15 - Account Takeover

Exploit Title: Microweber CMS 1.2.15 - Account Takeover Date: 2022-05-09 Exploit Author: Manojkumar J Vendor Homepage: https://github.com/microweber/microweber Software Link: https://github.com/microweber/microweber/releases/tag/v1.2.15 Version: =1.2.15 Tested on: Windows10 CVE : CVE-2022-1631...

Path Traversal via Files Manager

Description Please enter a description of the vulnerability. Steps to reproduce 1.Login to admin panel and go to Modules - Files http://localhost/microweber/admin/view:modules/loadmodule:files 2.Click any file, the url will have the following format:...

GHSA-G7R3-JWHW-2WFV Microweber Insufficient Session Expiry

Microweber v1.1.18 is affected by no session expiry after log-out...

Microweber Insufficient Session Expiry

Microweber v1.1.18 is affected by no session expiry after log-out...

Microweber Discloses Sensitive Information

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...

GHSA-PMXG-W9C7-FFMQ Microweber Discloses Sensitive Information

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request...

GHSA-89FP-J8V7-P82H Microweber allows Unrestricted File Upload

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...

Microweber allows Unrestricted File Upload

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...

Microweber XSS Vulnerability

Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...

GHSA-XMCR-X5X3-GJFX Microweber XSS Vulnerability

Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...

Microweber XSS Vulnerability

Microweber 1.0.8 has reflected cross-site scripting XSS vulnerabilities...

GHSA-582J-M369-HJ2F Microweber XSS Vulnerability

Microweber 1.0.8 has reflected cross-site scripting XSS vulnerabilities...

The microweber application allows large characters to insert in the input field "Email" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request

POC: 1. Go to home page http://127.0.0.1/ and there will a option to signup with email and phone number with 3 check box 2. Screenshot: -- https://ibb.co/F3tPVWY 3. Fill the email parameter with huge characters 4. when the admin check the notification http://127.0.0.1/admin/notification it will b...

Improper Access Control

microweber/microweber is vulnerable to improper access control. The vulnerability exists in index.blade.php due to lack of validations in emails confirmation which allows an attacker to view data and perform unauthorized actions such as registering accounts and modifying confidential information...

Incorrect Authorization in microweber

Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain...