Command Injection in microweber/microweber

Authentication Bypass by Spoofing in microweber/microweber

Static Code Injection in microweber/microweber

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page

File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component

Improper Privilege Management in microweber/microweber

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack

An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious…

Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber

An issue was discovered in Microweber 1.0.7

Microweber CMS 2.0 has Weak Password Requirements

Microweber 1.1.18 is affected by insufficient session expiration

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option…

Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field

A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript…

Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method

Use of Hard-coded Credentials in microweber/microweber

Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber

Integer Overflow or Wraparound in microweber/microweber

Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber

Generation of Error Message Containing Sensitive Information in microweber/microweber

Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11

Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request

Microweber API Endpoint thumbnail_img userfiles_path path traversal

Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates

Microweber CMS Authenticated Local File Inclusion via Backup API

Unrestricted Upload of File with Dangerous Type in microweber/microweber

OS Command Injection in microweber/microweber

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature

Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber

Business Logic Errors in microweber/microweber

Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweber

Insecure Storage of Sensitive Information in microweber/microweber

Insertion of Sensitive Information Into Debugging Code in microweber/microweber

Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11

Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19

Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of…

Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript

Microweber Settings index.php cross site scripting

Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint…

A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script…

microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php

microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php