1398 matches found
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the name attribute in edittaggingtag.php, allowing an attacker to inject and execute malicious javascript...
GHSA-232P-59MG-F98P Microweber Cross-site Scripting can result in redirection to a malicious site
Microweber versions 1.3.1 and prior are vulnerable to HTML injection that an attacker can use to redirect someone to a malicious site. A patch is available at commit 68f0721571653db865a5fa01c7986642c82e919c and expected to be part of version 1.3.2...
Microweber Cross-site Scripting can result in redirection to a malicious site
Microweber versions 1.3.1 and prior are vulnerable to HTML injection that an attacker can use to redirect someone to a malicious site. A patch is available at commit 68f0721571653db865a5fa01c7986642c82e919c and expected to be part of version 1.3.2...
Microweber vulnerable to HTML Injection in create tag functionality
HTML injection attack is closely related to Cross-site Scripting XSS. HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit...
GHSA-GM8C-W9CM-C445 Microweber vulnerable to HTML Injection in create tag functionality
HTML injection attack is closely related to Cross-site Scripting XSS. HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit...
CVE-2022-3242
Code Injection in GitHub repository microweber/microweber prior to 1.3.2...
Code injection
Code Injection in GitHub repository microweber/microweber prior to 1.3.2...
CVE-2022-3242 HTML code Injection in template search keyword in microweber/microweber
Code Injection in GitHub repository microweber/microweber prior to 1.3.2...
CVE-2022-3242 HTML code Injection in template search keyword in microweber/microweber
Code Injection in GitHub repository microweber/microweber prior to 1.3.2...
CVE-2022-3242
CVE-2022-3242 affects microweber/microweber prior to version 1.3.2. The issue is a Code Injection/HTML injection in the search path (e.g., search.php?keywords=) that can be exploited to inject JavaScript, with potential consequences such as credential/session exposure and content modification as ...
Microweber 跨站脚本漏洞
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber versions prior to 1.3.2. An attacker can...
Microweber 跨站脚本漏洞
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber, which stems from an HTML...
HTML Injection vulnerability in create tag functionality
Vulnerability Details In the Microweber CMS, While doing a live edit on to the application, we have the option to create a new global tag in the application. While creating a global tag, the "Tag Name" input field doesn't properly get sanitized and it's vulnerable to HTML Injection vulnerability...
Microweber's title parameter in the body of POST request vulnerable to stored XSS
In Microweber prior to v1.3.1, the title parameter in the body of POST request when creating/editing a category is vulnerable to stored cross-site scripting...
GHSA-CF6R-Q678-F2P7 Microweber's title parameter in the body of POST request vulnerable to stored XSS
In Microweber prior to v1.3.1, the title parameter in the body of POST request when creating/editing a category is vulnerable to stored cross-site scripting...
Cross Site Scripting (XSS)
Microweber is vulnerable to stored Cross Site Scripting. The vulnerability is due to improper sanitization in the product category title field. An authenticated attacker can add or modify a category, adding an Iframe script tag to the title that will run arbitrary Javascript whenever a user visit...
CVE-2022-2777
Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.3.1...
CVE-2022-2777
Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.3.1...
