Microweber
Page 2 of 2 — Microweber CVEs from a corpus of 120, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0504 | Medium | 6.5 | 2022-02-08 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0379 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0378 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0282 | Medium | 4.3 | 2022-01-20 | Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0281 | High | 7.5 | 2022-01-20 | Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0278 | Medium | 5.4 | 2022-01-20 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0277 | Medium | 6.5 | 2022-01-20 | Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11. |
CVE-2021-33988 | Medium | 6.1 | 2021-10-19 | Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting c… |
CVE-2020-28337 | High | 7.2 | 2021-02-15 | A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backu… |
CVE-2020-23140 | High | 8.1 | 2020-11-09 | Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any… |
CVE-2020-23139 | Medium | 5.5 | 2020-11-09 | Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to… |
CVE-2020-23138 | Critical | 9.8 | 2020-11-09 | An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension (eg- .ex… |
CVE-2020-23136 | Medium | 5.5 | 2020-11-09 | Microweber v1.1.18 is affected by no session expiry after log-out. |
CVE-2020-13405 | High | 7.5 | 2020-07-16 | userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POS… |
CVE-2020-13241 | High | 7.8 | 2020-05-20 | Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with t… |
CVE-2018-19917 | Medium | 6.1 | 2019-03-21 | Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities. |
CVE-2018-1000826 | Medium | 6.1 | 2018-12-20 | Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code. |
CVE-2018-17104 | High | 8.8 | 2018-09-16 | An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user. |
CVE-2014-9464 | | 2015-01-03 | SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute arbitrary SQL commands via the category p… | |
CVE-2013-5984 | | 2014-05-12 | Directory traversal vulnerability in userfiles/modules/admin/backup/delete.php in Microweber before 0.830 allows remote attackers to delete arbitrary files via… |