1388 matches found
Unrestricted Upload Of File With Dangerous Type
microweber is vulnerable to unrestricted upload of file with dangerous type. The vulnerability exists due to a lack of sanitization of dangerous file type...
Microweber Cross-Site Scripting Vulnerability (CNVD-2022-20688)
Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework. Microweber suffers from a cross-site scripting vulnerability, which can be exploited by attackers to upload . azhtml file e.g. ahtml, bhtml, chtml, ddhtml, as long as it ends in html. After uploading,...
Microweber Cross-Site Scripting Vulnerability (CNVD-2022-20797)
Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework. Microweber is vulnerable to a cross-site scripting vulnerability that stems from a file upload filter that fails to properly validate input parameters, which could be exploited to construct a stored XSS,...
Cross-site Scripting in microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
Cross-site Scripting in microweber
XSS on dynamictext module in GitHub repository microweber/microweber prior to 1.2.12...
GHSA-3Q55-66G3-P8XQ Cross-site Scripting in microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
GHSA-2CV6-6437-39P2 Cross-site Scripting in microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Proof of Concept 1. Go to add post http://site.com/admin/post/create 2. click on create new post 3. There will a option called post title 4. Fill the input field with huge characters, more than 1 lakh 5. Copy the below payload and put it in the input fields and click on continue. 6. You will see...
CVE-2022-0930
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0930
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0930 File upload filter bypass leading to stored XSS in microweber/microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0930
CVE-2022-0930 affects microweber/microweber. The issue is a file upload filter bypass that allows stored XSS via uploaded HTML-like files, reported for versions prior to 1.2.12. The root cause is inadequate validation/filtration of uploads enabling JavaScript execution on access. Remediation per ...
CVE-2022-0930 File upload filter bypass leading to stored XSS in microweber/microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0929
XSS on dynamictext module in GitHub repository microweber/microweber prior to 1.2.11...
CVE-2022-0929
XSS on dynamictext module in GitHub repository microweber/microweber prior to 1.2.11...
Cross site scripting
XSS on dynamictext module in GitHub repository microweber/microweber prior to 1.2.11...
CVE-2022-0929 XSS on dynamic_text module in microweber/microweber
XSS on dynamictext module in GitHub repository microweber/microweber prior to 1.2.11...
CVE-2022-0929 XSS on dynamic_text module in microweber/microweber
XSS on dynamictext module in GitHub repository microweber/microweber prior to 1.2.11...
CVE-2022-0929
The CVE-2022-0929 issue affects microweber/microweber, specifically the dynamic_text module. Reported as a cross-site scripting (XSS) vulnerability in the dynamic_text component, with vulnerable versions noted as prior to 1.2.11 (and related advisories referencing up to 1.2.12). The root cause is...