microweber/microweber

5 results · Clear filters · Feed

• Medium 6.1
  CVE-2025-34076 Public exploit

  Microweber CMS Authenticated Local File Inclusion via Backup API

  An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files fr…

  microweber CMS microweber/microweber Packagist
  Jul 2, 2025
• Medium 6.1
  CVE-2024-33298 Public exploit

  Microweber Cross-site Scripting vulnerability

  Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup

  microweber/microweber Packagist
  Jan 10, 2025
• Medium 4.7
  CVE-2024-33299 Public exploit

  Microweber Cross-site Scripting vulnerability

  Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users

  microweber/microweber Packagist
  Jan 10, 2025
• Medium 4.7
  CVE-2024-33297 Public exploit

  Microweber Cross-site Scripting vulnerability

  Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function

  microweber/microweber Packagist
  Jan 10, 2025
• Medium 6.8
  CVE-2022-1631 Public exploit

  Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

  Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s E…

  microweber microweber/microweber microweber/microweber Packagist
  May 9, 2022