1397 matches found
PT-2024-29387 · Unknown · Microweber
Name of the Vulnerable Software and Affected Versions: microweber version 2.0.16 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It affects the admin.php file located in the userfilesmodulessettings directory. Recommendations: For microweber version 2.0.16, consider...
CVE-2024-41381
microweber 2.0.16 was discovered to contain a Cross Site Scripting XSS vulnerability via userfiles\modules\settings\admin.php...
Microweber 2.0.15 - Stored XSS Vulnerability
Exploit Title: Stored XSS in Microweber Exploit Author: tmrswrr Vendor Homepage: https://microweber.me/ Version: 2.0.15 Tested on: http://active.demo.microweber.me/ Vulnerability Description A Stored Cross-Site Scripting XSS vulnerability has been identified in Microweber version 2.0.15. This...
Microweber 2.0.15 - Stored XSS
Exploit Title: Stored XSS in Microweber Date: 06/18/2024 Exploit Author: tmrswrr Vendor Homepage: https://microweber.me/ Version: 2.0.15 Tested on: http://active.demo.microweber.me/ Vulnerability Description A Stored Cross-Site Scripting XSS vulnerability has been identified in Microweber version...
Microweber 2.0.15 Cross Site Scripting
Exploit Title: Stored XSS in Microweber Date: 06/18/2024 Exploit Author: tmrswrr Vendor Homepage: https://microweber.me/ Version: 2.0.15 Tested on: http://active.demo.microweber.me/ Vulnerability Description A Stored Cross-Site Scripting XSS vulnerability has been identified in Microweber version...
VulnCheck KEV: CVE-2022-1439
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction...
Business Logic Errors
microweber is vulnerable to Business Logic Errors. The vulnerability exists due to a lack of coupon code validation. which allows attackers to change coupon codes and lower prices...
GHSA-QJFX-FVX7-3WVW Business Logic Errors in microweber/microweber
A vulnerability has been identified in microweber where users can purchase items with a coupon code. If the admin disables the use of the coupon code functionality, but the user sends requests to the API that handles the coupon code, the user can exploit the vulnerability and obtain items at a...
Business Logic Errors in microweber/microweber
A vulnerability has been identified in microweber where users can purchase items with a coupon code. If the admin disables the use of the coupon code functionality, but the user sends requests to the API that handles the coupon code, the user can exploit the vulnerability and obtain items at a...
CVE-2023-6832
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...
Code injection
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...
CVE-2023-6832 Business Logic Errors in microweber/microweber
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...
CVE-2023-6832 Business Logic Errors in microweber/microweber
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...
CVE-2023-6832 Business Logic Errors in microweber/microweber
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...
CVE-2023-6832
CVE-2023-6832 affects microweber/microweber prior to 2.0. A business logic flaw enables bypass of coupon code validation, allowing attackers to obtain items at reduced prices when the coupon feature is disabled. Public sources (GHSA and Veracode advisories) describe the coupon-validation bypass a...
Microweber Security Breach
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber versions prior to 2.0, which stems from a...
PT-2023-32783 · Microweber · Microweber
Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 2.0 Description: A vulnerability has been identified in microweber where users can exploit business logic errors to obtain items at a lower price. This occurs when the admin disables the use of the coup...
Account Takeover
microweber/microweber is vulnerable to Account Takeover. The vulnerability exists because login credentials are passed through the GET request, allowing an attacker to capture credentials through network traffic, potentially leading to account takeover...
Information Disclosure
microweber/microweber is vulnerable to Information Disclosure. The vulnerability exists due the file upload functionality, which allows an attacker to upload a ZIP file, which will result in an error containing sensitive system information...
GHSA-P8Q6-QRGJ-7GX2 Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method
An issue present in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method...