Priority HIGH 77
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the p…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.03369 · Published 2026-07-23 · No fix listed CWE-22
Priority HIGH 76
Command Injection in GitHub repository microweber/microweber prior to 1.3.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01799 · Published 2023-04-05 · Fixed in 1.3.3 CWE-77
Priority HIGH 73
Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00706 · Published 2023-04-22 · Fixed in 1.3.4 CWE-269
Priority HIGH 73
Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0144 · Published 2022-11-22 · No fix listed CWE-74
Priority HIGH 72
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00918 · Published 2026-07-24 · No fix listed CWE-94
Priority HIGH 72
Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00653 · Published 2023-09-30 · Fixed in 2.0 CWE-798
Priority HIGH 69
Microweber CMS 2.0 has Weak Password Requirements.
CVSS 3.1HIGH 8.3· Network · No auth · User interaction · EPSS 0.00458 · Published 2025-10-24 · No fix listed CWE-521
Priority HIGH 68
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00555 · Published 2022-12-22 · Fixed in 1.3.2 CWE-79
Priority HIGH 68
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00659 · Published 2022-12-21 · Fixed in 1.3.2 CWE-79
Priority HIGH 68
HTML injection attack is closely related to Cross-site Scripting (XSS).
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00739 · Published 2022-09-20 · Fixed in 1.3.2 CWE-94
Priority HIGH 66
Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00595 · Published 2025-08-01 · No fix listed CWE-79
Priority HIGH 66
A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00577 · Published 2025-07-31 · No fix listed CWE-79
Priority HIGH 65
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.38236 · Published 2022-12-24 · Fixed in 1.3.2 CWE-434
Priority MEDIUM 63
Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00261 · Published 2025-12-11 · No fix listed CWE-79
Priority MEDIUM 63
OS Command Injection in Packagist microweber/microweber prior to 1.2.11.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.51193 · Published 2022-02-11 · Fixed in 1.2.11 CWE-78
Priority MEDIUM 62
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2023-04-22 · Fixed in 1.3.4 CWE-359
Priority MEDIUM 62
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.44259 · Published 2022-02-18 · Fixed in 1.2.11 CWE-93
Priority MEDIUM 60
Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00311 · Published 2026-02-05 · Fixed in 2.0.20 CWE-79
Priority MEDIUM 60
Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00308 · Published 2026-02-05 · Fixed in 2.0.20 CWE-79
Priority MEDIUM 60
An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API.
CVSS 4.0MEDIUM 6.1· Network · Low privileges · No interaction · EPSS 0.02291 · Published 2025-07-02 · Fixed in 1.2.11 CWE-22
Priority MEDIUM 60
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00307 · Published 2024-08-05 · No fix listed CWE-79
Priority MEDIUM 60
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00307 · Published 2024-08-05 · No fix listed CWE-79
Priority MEDIUM 60
Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00884 · Published 2025-01-10 · No fix listed CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01122 · Published 2023-09-28 · Fixed in 2.0 CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00493 · Published 2023-04-05 · Fixed in 1.3.3 CWE-79
Load more
THREATIST.IORead the docs