Account Takeover Through Password Reset Poisoning

Microweber 1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33012

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

Design/Logic Flaw

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

Microweber 注入漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images and more. A host header injection vulnerability exists in Microweber v1.2.15. An attacker can explo...

CVE-2022-33012

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33012

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33012

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

PT-2022-21645

Name of the Vulnerable Software and Affected Versions Microweber version 1.2.15 Description The issue allows attackers to perform an account takeover via a host header injection attack. This enables unauthorized access to user accounts, potentially leading to data breaches or other malicious...

CVE-2022-33012: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33012

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack...

CVE-2022-33012

CVE-2022-33012 affects Microweber v1.2.15, where a host header injection flaw can enable an attacker to take over accounts via password-reset poisoning. The connected documents consistently reference an account takeover vulnerability in Microweber v1.2.15 stemming from host header manipulation. T...

Cross-site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scripting. The vulnerability exists due to the vulnerable microweber-templates/bootstrap5, microweber-templates/new-world and microweber-templates/shopmag dependencies used in composer.json, allowing an attacker to inject and execute malicious...

Cross-site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the name attribute in edittaggingtag.php, allowing an attacker to inject and execute malicious javascript...

GHSA-232P-59MG-F98P Microweber Cross-site Scripting can result in redirection to a malicious site

Microweber versions 1.3.1 and prior are vulnerable to HTML injection that an attacker can use to redirect someone to a malicious site. A patch is available at commit 68f0721571653db865a5fa01c7986642c82e919c and expected to be part of version 1.3.2...

Microweber Cross-site Scripting can result in redirection to a malicious site

Microweber versions 1.3.1 and prior are vulnerable to HTML injection that an attacker can use to redirect someone to a malicious site. A patch is available at commit 68f0721571653db865a5fa01c7986642c82e919c and expected to be part of version 1.3.2...

Microweber vulnerable to HTML Injection in create tag functionality

HTML injection attack is closely related to Cross-site Scripting XSS. HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit...

GHSA-GM8C-W9CM-C445 Microweber vulnerable to HTML Injection in create tag functionality

HTML injection attack is closely related to Cross-site Scripting XSS. HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit...

CVE-2022-3242

Code Injection in GitHub repository microweber/microweber prior to 1.3.2...

Code injection

Code Injection in GitHub repository microweber/microweber prior to 1.3.2...

CVE-2022-3242

CVE-2022-3242 affects microweber/microweber prior to version 1.3.2. The issue is a Code Injection/HTML injection in the search path (e.g., search.php?keywords=) that can be exploited to inject JavaScript, with potential consequences such as credential/session exposure and content modification as ...