Skip to content
OpenAdvisories

Package · Packagist

microweber/microweber

106 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2025-34076 Public exploit

    Microweber CMS Authenticated Local File Inclusion via Backup API

    An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files fr…

    microweber CMS microweber/microweber Packagist
  • Medium 6.1
    CVE-2024-33298 Public exploit

    Microweber Cross-site Scripting vulnerability

    Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup

    microweber/microweber Packagist
  • Medium 4.7
    CVE-2024-33299 Public exploit

    Microweber Cross-site Scripting vulnerability

    Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users

    microweber/microweber Packagist
  • Medium 4.7
    CVE-2024-33297 Public exploit

    Microweber Cross-site Scripting vulnerability

    Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function

    microweber/microweber Packagist
  • High 8.8
    CVE-2023-49052 Public exploit

    Microweber file upload vulnerability

    File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component.

    microweber/microweber Packagist
  • Medium 6.8
    CVE-2022-1631 Public exploit

    Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

    Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s E…

    microweber microweber/microweber microweber/microweber Packagist
  • High 8.1
    CVE-2022-0557 Public exploit EPSS 51%

    OS Command Injection in microweber/microweber

    OS Command Injection in Packagist microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • High 7.2
    CVE-2020-28337 Public exploit EPSS 17%

    Zip slip in Microweber

    A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an adminis…

    microweber/microweber Packagist
  • High 7.5
    CVE-2020-13405 Public exploit Scanner template EPSS 14%

    Microweber Discloses Sensitive Information

    userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.

    microweber/microweber Packagist