MI
Product
microweber
119
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 29Medium 84Low 0
Watch
Add microweber to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-0921 | 6.7 | Mar 11 | Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber Affected: before 1.2.12 |
| CVE-2023-6566 | 6.5 | Dec 7 | Business Logic Errors in microweber/microweber Affected: before 2.0.0 |
| CVE-2023-2239 | 6.5 | Apr 22 | Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweber Affected: before 1.3.4 |
| CVE-2022-0724 | 6.5 | Feb 23 | Insecure Storage of Sensitive Information in microweber/microweber Affected: before 1.3 |
| CVE-2022-0721 | 6.5 | Feb 23 | Insertion of Sensitive Information Into Debugging Code in microweber/microweber Affected: before 1.3 |
| CVE-2022-0504 | 6.5 | Feb 8 | Generation of Error Message Containing Sensitive Information in microweber/microweber Affected: before 1.2.11 |
| CVE-2022-0505 | 6.5 | Feb 8 | Cross-Site Request Forgery (CSRF) in microweber/microweber Affected: before 1.2.11 |
| CVE-2022-0277 | 6.5 | Jan 20 | Incorrect Permission Assignment for Critical Resource in microweber/microweber Affected: through 1.2.10 |
| CVE-2025-70792 | 6.1 | Feb 5 | Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19 Affected: 2.0.19 |
| CVE-2025-70791 | 6.1 | Feb 5 | Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19 Affected: 2.0.19 |
| CVE-2025-51502 | 6.1 | Aug 1 | Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of… Affected: 2.0.0 |
| CVE-2025-51501 | 6.1 | Aug 1 | Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript Affected: 2.0.0 |
| CVE-2025-2214 | 6.1 | Mar 11 | Microweber Settings index.php cross site scripting Affected: 2.0.19 |
| CVE-2024-33298 | 6.1 | Jan 10 | Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint… Affected: through 2.0.9 |
| CVE-2024-40101 | 6.1 | Aug 6 | A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script… Affected: through 2.0.15 |
| CVE-2024-41381 | 6.1 | Aug 5 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php Affected: 2.0.16 |
| CVE-2024-41380 | 6.1 | Aug 5 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php Affected: 2.0.16 |
| CVE-2023-5244 | 6.1 | Sep 28 | Cross-site Scripting (XSS) - Reflected in microweber/microweber Affected: before 2.0 |
| CVE-2021-32857 | 6.1 | Feb 20 | Cockpit vulnerable to Cross-site Scripting Affected: 0.12.2 through 0.12.2 |
| CVE-2021-32856 | 6.1 | Feb 20 | Microweber vulnerable to Cross-site Scripting Affected: 1.2.12 through 1.2.12 |
| CVE-2022-4647 | 6.1 | Dec 22 | Cross-site Scripting (XSS) - Stored in microweber/microweber Affected: through 1.3.1 |
| CVE-2022-4617 | 6.1 | Dec 21 | Cross-site Scripting (XSS) - Reflected in microweber/microweber Affected: through 1.3.1 |
| CVE-2022-0698 | 6.1 | Nov 25 | Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter Affected: 1.3.1 |
| CVE-2022-3245 | 6.1 | Sep 20 | Code Injection in display of tag title on saving tags in microweber/microweber Affected: before 1.3.2 |
| CVE-2022-3242 | 6.1 | Sep 20 | HTML code Injection in template search keyword in microweber/microweber Affected: before 1.3.2 |
| CVE-2022-2470 | 6.1 | Jul 22 | Cross-site Scripting (XSS) - Reflected in microweber/microweber Affected: before 1.2.21 |
| CVE-2022-2353 | 6.1 | Jul 9 | Cross-Site Request Forgery (CSRF) in microweber/microweber Affected: before 1.2.20 |
| CVE-2022-2252 | 6.1 | Jun 29 | Open Redirect in microweber/microweber Affected: before 1.2.19 |
| CVE-2022-2174 | 6.1 | Jun 22 | Cross-site Scripting (XSS) - Reflected in microweber/microweber Affected: before 1.2.18 |
| CVE-2022-2130 | 6.1 | Jun 20 | Cross-site Scripting (XSS) - Reflected in microweber/microweber Affected: before 1.2.17 |
| CVE-2022-1584 | 6.1 | May 4 | Reflected XSS in microweber/microweber Affected: before 1.2.16 |
| CVE-2022-1555 | 6.1 | May 4 | DOM XSS in microweber ver 1.2.15 in microweber/microweber Affected: before 1.2.16 |
| CVE-2022-1504 | 6.1 | Apr 27 | XSS in /demo/module/?module=HERE in microweber/microweber Affected: before 1.2.15 |
| CVE-2022-1439 | 6.1 | Apr 22 | Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber Affected: before 1.2.15 |
| CVE-2022-0929 | 6.1 | Mar 12 | XSS on dynamic_text module in microweber/microweber Affected: before 1.2.11 |
| CVE-2022-0690 | 6.1 | Feb 19 | Cross-site Scripting (XSS) - Reflected in microweber/microweber Affected: before 1.2.11 |
| CVE-2022-0678 | 6.1 | Feb 19 | Cross-site Scripting (XSS) - Reflected in microweber/microweber Affected: before 1.2.11 |
| CVE-2022-0597 | 6.1 | Feb 15 | Open Redirect in microweber/microweber Affected: before 1.2.11 |
| CVE-2022-0560 | 6.1 | Feb 11 | Open Redirect in microweber/microweber Affected: before 1.2.11 |
| CVE-2021-33988 | 6.1 | Oct 19 | Cross Site Scripting (XSS) Affected: 1.2.7 |
| CVE-2018-19917 | 6.1 | Mar 17 | Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities Affected: 1.0.8 |
| CVE-2018-1000826 | 6.1 | Dec 20 | Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code Affected: through 1.0.7 |
| CVE-2022-0968 | 5.5 | Mar 15 | The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber Affected: before 1.2.12 |
| CVE-2022-0961 | 5.5 | Mar 15 | The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber Affected: before 1.2.12 |
| CVE-2020-23139 | 5.5 | Nov 9 | Microweber 1.1.18 is affected by broken authentication and session management Affected: 1.1.18 |
| CVE-2020-23136 | 5.5 | Nov 9 | Microweber v1.1.18 is affected by no session expiry after log-out Affected: 1.1.18 |
| CVE-2024-58289 | 5.4 | Dec 11 | Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields Affected: 2.0.15 |
| CVE-2023-47379 | 5.4 | Nov 8 | Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality Affected: 2.0.1 |
| CVE-2023-3142 | 5.4 | Jun 7 | Cross-site Scripting (XSS) - Stored in microweber/microweber Affected: before 2.0 |
| CVE-2023-1881 | 5.4 | Apr 5 | Cross-site Scripting (XSS) - Stored in microweber/microweber Affected: before 1.3.3 |