1711 matches found
CVE-2025-34076
CVE-2025-34076 is an authenticated local file inclusion in Microweber CMS (versions ≤ 1.2.11) caused by insecure handling of the backup management API. The vulnerable components are the /api/BackupV2/upload and /api/BackupV2/download endpoints, which allow an absolute file path to be supplied via...
CVE-2025-34076 Microweber CMS Authenticated Local File Inclusion via Backup API
An authenticated local file inclusion vulnerability exists in Microweber CMS versions = 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By...
CVE-2025-34076
An authenticated local file inclusion vulnerability exists in Microweber CMS versions = 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By...
PT-2025-27668 · Unknown · Microweber Cms
Name of the Vulnerable Software and Affected Versions: Microweber CMS versions = 1.2.11 Description: An authenticated local file inclusion issue exists due to the misuse of the backup management API. Authenticated users can exploit the /api/BackupV2/upload and /api/BackupV2/download endpoints to...
Microweber CMS 路径遍历漏洞
Microweber CMS is a drag-and-drop website builder from Microweber Open Source. A path traversal vulnerability exists in Microweber CMS version 1.2.11 and earlier, which stems from a file inclusion issue that could lead to a file readout...
CVE-2025-34076: Improper Limitation of a Pathname to a Restricted Directory
An authenticated local file inclusion vulnerability exists in Microweber CMS versions = 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By...
CVE-2024-40101
A Reflected Cross-site scripting XSS vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter...
CVE-2024-41380
microweber 2.0.16 was discovered to contain a Cross Site Scripting XSS vulnerability via userfiles\modules\tags\addtaggingtagged.php...
CVE-2024-33297
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name Internal Name field in the Add new campaign function...
CVE-2024-33299
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users...
CVE-2024-33298
Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=adminbackup...
CVE-2023-5861
Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...
CVE-2023-5318
Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0...
CVE-2023-6599
Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0...
CVE-2023-2239
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4...
CVE-2023-2240
Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4...
CVE-2023-2014
Cross-site Scripting XSS - Generic in GitHub repository microweber/microweber prior to 1.3.3...
CVE-2023-1877
Command Injection in GitHub repository microweber/microweber prior to 1.3.3...