1398 matches found
Microweber 跨站脚本漏洞
Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A file upload vulnerability exists in versions of Microweber prior to 1.2.12, which stems from a lack of validation of...
Microweber remote code execution vulnerability
Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A remote code execution vulnerability exists in versions of microweber prior to 1.2.12, which...
Microweber file upload vulnerability
Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A file upload vulnerability exists in versions of Microweber prior to 1.2.11. The vulnerability stems from the lack of val...
The microweber application allows large characters to insert in the input field "SKU" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber
Go to add post http://site.com/admin/product/create click on create new product There will a option called SKU Fill the input field with huge characters, more than 1 lakh Copy the below payload and put it in the input fields and click on continue. You will see the application accepts large...
The microweber application allows large characters to insert in the input field "Leave comment" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber
Proof of Concept 1. Go to http://site/admin/view:content/action:posts 2. Create a page and enable to add comment option 3. Go to that page and there will a option called "Leave a comment" 4. Copy the below payload and put it in the "Leave a comment" field post a comment 5. Go to...
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber
Proof of Concept 1. Go to http://127.0.0.1/admin/view:modules/loadmodule:users/action:profile 2. Click on edit profile 3. Fill the first name & last name field with huge characters, more than 1 lakh 4. Copy the below payload and put it in the input fields and click on continue. 5. You will see th...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to cross-site scriptingXSS attacks. The vulnerable dynamictext module, allow attackers to inject and execute malicious javascript...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to cross-site scripting attacks. An attacker is able to inject and execute malicious javascript via bypassing the file upload filter...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to stored cross-site scripting. The vulnerability exists in add/edit tax in microweb due to lack of validations which allows an attacker to inject and execute arbitrary javascript...
Remote Code Execution (RCE)
microweber is vulnerable to remote code execution. The vulnerability exists due a lack of verification of a zip file in the Backup/Restore feature, allowing an attacker to inject maliciously crafted script into the system...
Unrestricted Upload Of File With Dangerous Type
microweber is vulnerable to unrestricted upload of file with dangerous type. The vulnerability exists due to a lack of sanitization of dangerous file type...
Microweber Cross-Site Scripting Vulnerability (CNVD-2022-20797)
Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework. Microweber is vulnerable to a cross-site scripting vulnerability that stems from a file upload filter that fails to properly validate input parameters, which could be exploited to construct a stored XSS,...
Microweber Cross-Site Scripting Vulnerability (CNVD-2022-20688)
Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework. Microweber suffers from a cross-site scripting vulnerability, which can be exploited by attackers to upload . azhtml file e.g. ahtml, bhtml, chtml, ddhtml, as long as it ends in html. After uploading,...
GHSA-3Q55-66G3-P8XQ Cross-site Scripting in microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
Cross-site Scripting in microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
Cross-site Scripting in microweber
XSS on dynamictext module in GitHub repository microweber/microweber prior to 1.2.12...
GHSA-2CV6-6437-39P2 Cross-site Scripting in microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Proof of Concept 1. Go to add post http://site.com/admin/post/create 2. click on create new post 3. There will a option called post title 4. Fill the input field with huge characters, more than 1 lakh 5. Copy the below payload and put it in the input fields and click on continue. 6. You will see...
