CVE-2026-67617 | Medium | 4.8 | 2026-08-03 | Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to i… |
CVE-2026-65693 | High | 7.2 | 2026-07-24 | Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command… |
CVE-2026-65694 | High | 7.5 | 2026-07-23 | Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitr… |
CVE-2025-70792 | Medium | 6.1 | 2026-02-05 | Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafte… |
CVE-2025-70791 | Medium | 6.1 | 2026-02-05 | Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in… |
CVE-2024-58289 | Medium | 5.4 | 2025-12-11 | Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields… |
CVE-2025-60954 | High | 8.3 | 2025-10-24 | Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set… |
CVE-2025-51504 | High | 7.6 | 2025-08-01 | Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. |
CVE-2025-51502 | Medium | 6.1 | 2025-08-01 | Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the… |
CVE-2025-51501 | Medium | 6.1 | 2025-08-01 | Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaS… |
CVE-2025-51503 | High | 7.6 | 2025-07-31 | A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbit… |
CVE-2025-34076 | High | 7.2 | 2025-07-02 | An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated user… |
CVE-2025-2214 | Low | 3.5 | 2025-03-12 | A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/sett… |
CVE-2024-33299 | Medium | 4.7 | 2025-01-10 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the… |
CVE-2024-33298 | Medium | 6.1 | 2025-01-10 | Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in th… |
CVE-2024-33297 | Medium | 4.7 | 2025-01-10 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the… |
CVE-2024-40101 | Medium | 6.1 | 2024-08-06 | A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject a… |
CVE-2024-41381 | Medium | 6.1 | 2024-08-05 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php. |
CVE-2024-41380 | Medium | 6.1 | 2024-08-05 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php. |
CVE-2023-6832 | Medium | 4.3 | 2023-12-15 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-48122 | High | 7.5 | 2023-12-08 | An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method. |
CVE-2023-6599 | Medium | 4.3 | 2023-12-08 | Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-6566 | Medium | 6.5 | 2023-12-07 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-49052 | High | 8.8 | 2023-11-30 | File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the crea… |
CVE-2023-47379 | Medium | 5.4 | 2023-11-08 | Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality. |
CVE-2023-5976 | Medium | 4.3 | 2023-11-07 | Improper Access Control in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-5861 | Medium | 4.8 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-5318 | High | 7.5 | 2023-09-30 | Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-5244 | Medium | 6.1 | 2023-09-28 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-3142 | Medium | 5.4 | 2023-06-07 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-2239 | Medium | 6.5 | 2023-04-22 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4. |
CVE-2023-2240 | High | 8.8 | 2023-04-22 | Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4. |
CVE-2023-2014 | Medium | 4.8 | 2023-04-13 | Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3. |
CVE-2023-1881 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. |
CVE-2023-1877 | Critical | 9.8 | 2023-04-05 | Command Injection in GitHub repository microweber/microweber prior to 1.3.3. |
CVE-2023-1081 | Medium | 4.8 | 2023-02-28 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. |
CVE-2021-32857 | Medium | 6.1 | 2023-02-21 | Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitizatio… |
CVE-2021-32856 | Medium | 6.1 | 2023-02-21 | Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS)… |
CVE-2023-0608 | Medium | 5.4 | 2023-02-01 | Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-4732 | High | 7.2 | 2022-12-27 | Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-4647 | Medium | 6.1 | 2022-12-22 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-4617 | Medium | 6.1 | 2022-12-21 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-0698 | Medium | 6.1 | 2022-11-25 | Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter. |
CVE-2022-33012 | High | 8.8 | 2022-11-22 | Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. |
CVE-2022-3245 | Medium | 6.1 | 2022-09-20 | HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScri… |
CVE-2022-3242 | Medium | 6.1 | 2022-09-20 | Code Injection in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-2777 | Medium | 5.4 | 2022-08-11 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1. |
CVE-2022-2470 | Medium | 6.1 | 2022-07-22 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21. |
CVE-2022-2495 | Medium | 4.8 | 2022-07-22 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21. |
CVE-2021-36461 | High | 8.8 | 2022-07-15 | An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictur… |
CVE-2022-2368 | Medium | 6.5 | 2022-07-11 | Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20. |
CVE-2022-2353 | Medium | 6.1 | 2022-07-09 | Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch cont… |
CVE-2022-2300 | Medium | 5.4 | 2022-07-04 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19. |
CVE-2022-2280 | Medium | 5.4 | 2022-07-01 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19. |
CVE-2022-2252 | Medium | 6.1 | 2022-06-29 | Open Redirect in GitHub repository microweber/microweber prior to 1.2.19. |
CVE-2022-2174 | Medium | 6.1 | 2022-06-22 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18. |
CVE-2022-2130 | Medium | 6.1 | 2022-06-20 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17. |
CVE-2022-1631 | High | 8.8 | 2022-05-09 | Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no… |
CVE-2022-1584 | Medium | 6.1 | 2022-05-04 | Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim |
CVE-2022-1555 | Medium | 6.1 | 2022-05-04 | DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie... |
CVE-2022-1504 | Medium | 6.1 | 2022-04-27 | XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks. |
CVE-2022-1439 | Medium | 6.1 | 2022-04-22 | Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user… |
CVE-2022-1036 | High | 7.5 | 2022-03-22 | Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0968 | Medium | 5.5 | 2022-03-15 | The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS)… |
CVE-2022-0963 | Medium | 5.4 | 2022-03-15 | Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0961 | Medium | 5.5 | 2022-03-15 | The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a… |
CVE-2022-0954 | Medium | 5.4 | 2022-03-15 | Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub r… |
CVE-2022-0930 | Medium | 4.8 | 2022-03-12 | File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0929 | Medium | 6.1 | 2022-03-12 | XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11. |
CVE-2022-0926 | Medium | 4.8 | 2022-03-12 | File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0921 | Medium | 6.7 | 2022-03-11 | Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0928 | Medium | 5.4 | 2022-03-11 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0913 | High | 7.5 | 2022-03-11 | Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0912 | Medium | 4.8 | 2022-03-11 | Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11. |
CVE-2022-0906 | Medium | 4.8 | 2022-03-10 | Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12. |
CVE-2022-0895 | Critical | 9.8 | 2022-03-10 | Static Code Injection in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0896 | High | 8.8 | 2022-03-09 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0855 | Medium | 6.1 | 2022-03-04 | Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4. |
CVE-2022-0777 | High | 7.5 | 2022-03-01 | Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0723 | Medium | 5.4 | 2022-02-26 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11. |
CVE-2022-0763 | Medium | 4.8 | 2022-02-26 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0762 | Medium | 5.5 | 2022-02-26 | Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0724 | Medium | 6.5 | 2022-02-23 | Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0721 | Medium | 6.5 | 2022-02-23 | Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0719 | Medium | 5.4 | 2022-02-23 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0688 | Medium | 4.9 | 2022-02-20 | Business Logic Errors in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0690 | Medium | 6.1 | 2022-02-19 | Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0689 | Medium | 5.3 | 2022-02-19 | Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0678 | Medium | 6.1 | 2022-02-19 | Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0666 | High | 7.5 | 2022-02-18 | CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0660 | High | 7.5 | 2022-02-18 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0638 | Medium | 4.3 | 2022-02-17 | Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0597 | Medium | 6.1 | 2022-02-15 | Open Redirect in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0596 | Medium | 4.3 | 2022-02-15 | Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0560 | Medium | 6.1 | 2022-02-11 | Open Redirect in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0557 | High | 7.2 | 2022-02-11 | OS Command Injection in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0558 | Medium | 5.4 | 2022-02-10 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0506 | Medium | 5.4 | 2022-02-08 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0505 | Medium | 6.5 | 2022-02-08 | Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0504 | Medium | 6.5 | 2022-02-08 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |