1544 matches found
CVE-2020-13241
CVE-2020-13241 affects Microweber 1.1.18. The issue is an uncontrolled/unrestricted file upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the added file’s extension corresponds to an image file. This can enable upload of non-image files via the Add Image option...
CVE-2020-13241: Unrestricted Upload of File with Dangerous Type
Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...
CVE-2018-19917
Microweber 1.0.8 has reflected cross-site scripting XSS vulnerabilities...
CVE-2018-19917
Microweber 1.0.8 has reflected cross-site scripting XSS vulnerabilities...
Cross site scripting
Microweber 1.0.8 has reflected cross-site scripting XSS vulnerabilities...
CVE-2018-19917
CVE-2018-19917 refers to Microweber 1.0.8 with a reflected XSS in the search.php endpoint via the keywords GET parameter. Technical details from the PacketStorm/Netsparker materials show an in-page script injection vector (e.g., keywords parameter) and indicate the advisory rated it high severity...
CVE-2018-19917
Microweber 1.0.8 has reflected cross-site scripting XSS vulnerabilities...
CVE-2018-19917: Improper Neutralization of Input During Web Page Generation
Microweber 1.0.8 has reflected cross-site scripting XSS vulnerabilities...
Microweber 1.0.8 Cross-Site Scripting Vulnerability
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber version 1.0.8. A remote attack...
Microweber 1.0.8 Cross Site Scripting
Reflected Cross-site Scripting Vulnerability in Microweber 1.0.8 Information -------------------- Advisory by Netsparker Name: Reflected Cross-site Scripting in Microweber Affected Software: Microweber Affected Versions: 1.0.8 Homepage: https://github.com/microweber/microweber Vulnerability:...
Cross-Site Scripting (XSS)
microweber/microweber susceptible to cross-site scripting XSS. The vulnerability is possible because Admin login template has user-controllable parameters...
CVE-2018-1000826
Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...
CVE-2018-1000826
Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...
Cross site scripting
Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...
CVE-2018-1000826
Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...
CVE-2018-1000826
CVE-2018-1000826 affects Microweber
PT-2018-9550
Name of the Vulnerable Software and Affected Versions Microweber versions prior to 1.1 Description The issue concerns a Cross Site Scripting XSS vulnerability in the Admin login form template, which can lead to the execution of JavaScript code. Recommendations For Microweber versions prior to 1.1...
CVE-2018-1000826: Improper Neutralization of Input During Web Page Generation
Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...
microweber.com XSS vulnerability
Open Bug Bounty ID: OBB-679811 Description| Value ---|--- Affected Website:| microweber.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Cross Site Request Forgery (CSRF)
microweber/microweber is susceptible to a cross-site request forgery CSRF attack. It allows the attacker to add an administrative account via the api/saveuser url by misleading an admin user to click on the malicious link...