46 matches found
CVE-2026-65694-PoC
CVE-2026-65694 — Microweber CMS: Lectura de archivos arbitrarios sin autenticación Prueba de concepto de CVE-2026-65694 , un path traversal sin autenticación → lectura arbitraria de archivos en Microweber CMS. Un atacante no autenticado puede leer cualquier archivo al que el usuario del servidor...
Exploit for CVE-2026-65694
CVE-2026-65694 — Microweber CMS Unauthenticated Arbitrary File...
CVE-2026-12198 Microweber API Endpoint thumbnail_img userfiles_path path traversal
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfilespath of the file /apinosession/thumbnailimg of the component API Endpoint. Executing a manipulation of the argument cachepathrelative can lead to path traversal. It is possible to launch the attack...
CVE-2026-12198 Microweber API Endpoint thumbnail_img userfiles_path path traversal
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfilespath of the file /apinosession/thumbnailimg of the component API Endpoint. Executing a manipulation of the argument cachepathrelative can lead to path traversal. It is possible to launch the attack...
CVE-2026-12198 Microweber API Endpoint thumbnail_img userfiles_path path traversal
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfilespath of the file /apinosession/thumbnailimg of the component API Endpoint. Executing a manipulation of the argument cachepathrelative can lead to path traversal. It is possible to launch the attack...
PT-2026-49149
Name of the Vulnerable Software and Affected Versions Microweber versions prior to 2.0.21 Description A path traversal issue exists in the API Endpoint component. A remote attacker can manipulate the cache path relative argument within the userfiles path function of the '/api nosession/thumbnail...
Actual Sync Server has an Authenticated Path Traversal
Description Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments ../ can escape the intended directory and write files outsid...
CVE-2025-51626
SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancelorder.php endpoint...
CVE-2025-51626
SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancelorder.php endpoint...
CVE-2025-51626: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancelorder.php endpoint...
EUVD-2026-1681
SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancelorder.php endpoint...
pss.sale.com 安全漏洞
pss.sale.com is a merchandising system by the individual developer XiaoLiuChu in China. A security vulnerability exists in version 1.0 of pss.sale.com, which stems from an incorrect manipulation of the parameter id in the endpoint userfiles/php/cancelorder.php, which could lead to a SQL injection...
CVE-2024-58280 CMSimple 5.15 Remote Command Execution via Extensions Configuration
CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensionsuserfiles and upload a shell script to the media directory to execute arbitrary code on the server...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in userfiles\modules\settings\admin.php by which an admin authenticated attacker can inject malicious scripts by submitting crafted input to the group field...
GHSA-HF66-XFGJ-42G8 Microweber Cross Site Scripting (XSS) vulnerability
Microweber 2.0.16 was discovered to contain a Cross Site Scripting XSS vulnerability via userfiles\modules\tags\addtaggingtagged.php...
Microweber Cross Site Scripting (XSS) vulnerability
Microweber 2.0.16 was discovered to contain a Cross Site Scripting XSS vulnerability via userfiles\modules\settings\admin.php...
CVE-2024-41381
microweber 2.0.16 was discovered to contain a Cross Site Scripting XSS vulnerability via userfiles\modules\settings\admin.php...
CVE-2024-41381
microweber 2.0.16 was discovered to contain a Cross Site Scripting XSS vulnerability via userfiles\modules\settings\admin.php...
CVE-2024-41381
Microweber version 2.0.16 is affected by a Cross-Site Scripting (XSS) vulnerability located in the `userfiles modules settings admin.phpfile. The root cause is a **lack of effective user-supplied data filtering and escaping**, which allows an attacker to inject a well-designed payload to execute ...