MI
Product
microweber
119
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 29Medium 84Low 0
Watch
Add microweber to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-49052 | 8.8 | Nov 30 | File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component Affected: 2.0.4 |
| CVE-2023-2240 | 8.8 | Apr 22 | Improper Privilege Management in microweber/microweber Affected: before 1.3.4 |
| CVE-2022-33012 | 8.8 | Nov 22 | Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack Affected: 1.2.15 |
| CVE-2021-36461 | 8.8 | Jul 15 | An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious… Affected: 1.1.3 |
| CVE-2022-1631 | 8.8 | May 9 | Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber Affected: before 1.2.15 |
| CVE-2022-0896 | 8.8 | Mar 9 | Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber Affected: before 1.3 |
| CVE-2018-17104 | 8.8 | Sep 16 | An issue was discovered in Microweber 1.0.7 Affected: 1.0.7 |
| CVE-2025-60954 | 8.3 | Oct 24 | Microweber CMS 2.0 has Weak Password Requirements Affected: 2.0.0 |
| CVE-2020-23140 | 8.1 | Nov 9 | Microweber 1.1.18 is affected by insufficient session expiration Affected: 1.1.18 |
| CVE-2020-13241 | 7.8 | May 20 | Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option… Affected: 1.1.18 |
| CVE-2025-51504 | 7.6 | Aug 1 | Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field Affected: 2.0.0 |
| CVE-2025-51503 | 7.6 | Jul 31 | A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript… Affected: 2.0.0 |
| CVE-2026-65694 | 7.5 | Jul 23 | Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController Affected: through 2.0.20 |
| CVE-2023-48122 | 7.5 | Dec 8 | An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method Affected: 2.0.1 before 2.0.4 |
| CVE-2023-5318 | 7.5 | Sep 30 | Use of Hard-coded Credentials in microweber/microweber Affected: before 2.0 |
| CVE-2022-1036 | 7.5 | Mar 22 | Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber Affected: before 1.2.12 |
| CVE-2022-0913 | 7.5 | Mar 11 | Integer Overflow or Wraparound in microweber/microweber Affected: through 1.2.11 |
| CVE-2022-0777 | 7.5 | Mar 1 | Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber Affected: before 1.3 |
| CVE-2022-0666 | 7.5 | Feb 18 | CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber Affected: before 1.2.11 |
| CVE-2022-0660 | 7.5 | Feb 18 | Generation of Error Message Containing Sensitive Information in microweber/microweber Affected: before 1.2.11 |
| CVE-2022-0282 | 7.5 | Jan 20 | Cross-site Scripting in microweber/microweber Affected: through 1.2.10 |
| CVE-2022-0281 | 7.5 | Jan 20 | Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber Affected: through 1.2.10 |
| CVE-2020-13405 | 7.5 | Jul 16 | userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request Affected: before 1.1.20 |
| CVE-2026-12198 | 7.3 | Jun 15 | Microweber API Endpoint thumbnail_img userfiles_path path traversal Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +15 more |
| CVE-2026-65693 | 7.2 | Jul 24 | Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates Affected: through 2.0.20 |
| CVE-2025-34076 | 7.2 | Jul 2 | Microweber CMS Authenticated Local File Inclusion via Backup API Affected: through 1.2.11 |
| CVE-2022-4732 | 7.2 | Dec 24 | Unrestricted Upload of File with Dangerous Type in microweber/microweber Affected: through 1.3.1 |
| CVE-2022-0557 | 7.2 | Feb 11 | OS Command Injection in microweber/microweber Affected: before 1.2.11 |
| CVE-2020-28337 | 7.2 | Feb 15 | A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature Affected: through 1.1.20 |
Showing 29