64 results · Clear filters · Feed
-
Medium 6.1
Microweber Cross-site Scripting vulnerability
Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in…
-
Medium 6.1
Microweber has a Cross-site Scripting vulnerability
Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code exec…
-
Medium 6.1CVE-2025-51501 Scanner template
Microweber has Reflected XSS Vulnerability in the id Parameter
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
-
Medium 6.1CVE-2025-51502 Scanner template
Microweber has Reflected XSS Vulnerability in the layout Parameter
Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.
-
Medium 6.1CVE-2025-34076 Public exploit
Microweber CMS Authenticated Local File Inclusion via Backup API
An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files fr…
-
Medium 6.1CVE-2024-33298 Public exploit
Microweber Cross-site Scripting vulnerability
Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup
-
Medium 4.7CVE-2024-33299 Public exploit
Microweber Cross-site Scripting vulnerability
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users
-
Medium 4.7CVE-2024-33297 Public exploit
Microweber Cross-site Scripting vulnerability
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function
-
Medium 6.1
Microweber Cross Site Scripting (XSS) vulnerability
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.
-
Medium 6.1
Microweber Cross Site Scripting (XSS) vulnerability
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.
-
Medium 6.0
Business Logic Errors in microweber/microweber
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
-
Medium 5.9
Business Logic Errors in microweber/microweber
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
-
Medium 5.4
Microweber Cross-site Scripting vulnerability
Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.
-
Medium 4.6
Improper Access Control in microweber/microweber
Improper Access Control in GitHub repository microweber/microweber prior to 2.0.
-
Medium 6.4
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
-
Medium 5.8
Use of Hard-coded Credentials in microweber/microweber
Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.
-
Medium 5.0CVE-2023-5244 Scanner template
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
-
Medium 5.3
Cross-site Scripting (XSS) - Generic in microweber/microweber
Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.
-
Medium 6.1
Command Injection in microweber/microweber
Command Injection in GitHub repository microweber/microweber prior to 1.3.3.
-
Medium 5.7
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
-
Medium 6.1
Microweber vulnerable to Cross-site Scripting
Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload int…
-
Medium 6.3
Cross-site Scripting (XSS) - DOM in microweber/microweber
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
-
Medium 4.7CVE-2022-4732 EPSS 38%
Unrestricted Upload of File with Dangerous Type in microweber/microweber
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
-
Medium 5.1
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.
-
Medium 6.1
Microweber vulnerable to cross-site scripting (XSS)
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.
-
Medium 4.3
Code Injection in display of tag title on saving tags in microweber/microweber
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
-
Medium 4.3CVE-2022-3242 Scanner template
HTML code Injection in template search keyword in microweber/microweber
Code Injection in GitHub repository microweber/microweber prior to 1.3.2.
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.
-
Medium 6.5
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.
-
Medium 6.5
Authentication Bypass by Spoofing in microweber/microweber
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.
-
Medium 6.3
Cross-Site Request Forgery (CSRF) in microweber/microweber
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user.
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
-
Medium 4.3
Open Redirect in microweber/microweber
Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
-
Medium 6.5CVE-2022-2174 Scanner template
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.
-
Medium 6.5CVE-2022-2130 Scanner template
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.
-
Medium 6.8CVE-2022-1631 Public exploit
Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber
Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s E…
-
Medium 6.3
Reflected XSS in microweber/microweber
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
-
Medium 6.3
XSS in /demo/module/?module=HERE in microweber/microweber
XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.