1398 matches found
CVE-2022-2495
Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.2.21...
Cross site scripting
Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.2.21...
CVE-2022-2495 Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.2.21...
CVE-2022-2495
Microweber (GitHub: microweber/microweber) is affected by a stored Cross-site Scripting (XSS) vulnerability arising in versions prior to 1.2.21. The issue stems from how SVG uploads are handled, allowing stored XSS when users upload SVG files. Multiple sources (CVE-2022-2495 records, CNVD-2022-54...
Microweber 跨站脚本漏洞
Microweber is a drag-and-drop online store management system from the US Microweber community. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.2.21. An attacker could use this vulnerability to execute...
The vulnerability of the Microweber content management system arises from the lack of measures taken to protect the website structure, allowing attackers to carry out XSS attacks.
The vulnerability of the Microweber content management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
Microweber 跨站脚本漏洞
Microweber is an online store management system that provides drag-and-drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.2.21, which...
CVE-2021-36461
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...
CVE-2021-36461
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...
Privilege escalation
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...
CVE-2021-36461
CVE-2021-36461 is an arbitrary file upload vulnerability in Microweber 1.1.3. An attacker can upload a malicious image through the Settings Upload Picture option (using user.ini) to achieve shell access. Affected component: Microweber web application; vulnerability type: arbitrary file upload; im...
CVE-2021-36461
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...
Microweber 代码问题漏洞
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A code issue vulnerability exists in Microweber 1.1.3, which can be exploited by an...
Business Logic Errors
microweber/microweber is vulnerable to business logic errors. The vulnerability exists in the login function of UserManager.php due to lack of validations in user headers which allows a malicious attacker to bypass IP detection and perform brute-force attacks...
GHSA-9WQR-9787-P4RF Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password
In the login API, an IP address will by default be blocked when the user tries to login incorrectly more than 5 times. However, a bypass to this mechanism is possible by abusing a X-Forwarded-For header to bypass IP detection and perform a password brute-force. A patch for this issue is available...
Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password
In the login API, an IP address will by default be blocked when the user tries to login incorrectly more than 5 times. However, a bypass to this mechanism is possible by abusing a X-Forwarded-For header to bypass IP detection and perform a password brute-force. A patch for this issue is available...
CVE-2022-2368
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20...
CVE-2022-2368
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20...