microweber

Records121All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high30CVSS 7.0–8.9

Exploited now

microweber records in CISA KEV

No microweber vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Microweber 114 records HIGH Whmcs 1 record LOW

Records

114 records in Microweber · all components

TI-2023-01763 CVE-2023-1877 · GHSA-582p-2fpg-x226

Command Injection in microweber/microweber

HIGH 76

Command Injection in GitHub repository microweber/microweber prior to 1.3.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01799 Published 2023-04-05 Fixed in 1.3.3 CWE-77

TI-2023-02100 CVE-2023-2240 · GHSA-r6xq-xcxc-fghx

Improper Privilege Management in microweber/microweber

HIGH 73

Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00706 Published 2023-04-22 Fixed in 1.3.4 CWE-269

TI-2022-14518 CVE-2022-33012 · GHSA-rp7f-fhm8-9hpf

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.

HIGH 73

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0144 Published 2022-11-22 No fix listed CWE-74

TI-2023-04891 CVE-2023-5318 · GHSA-r657-3wqh-g2x9

Use of Hard-coded Credentials in microweber/microweber

HIGH 72

Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00653 Published 2023-09-30 Fixed in 2.0 CWE-798

TI-2025-37870 CVE-2025-60954 · GHSA-526h-6368-hcf5

Microweber CMS 2.0 has Weak Password Requirements.

HIGH 69

Microweber CMS 2.0 has Weak Password Requirements.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00458 Published 2025-10-24 No fix listed CWE-521

TI-2022-04247 CVE-2022-4647 · GHSA-9cmm-52cv-6hvc

Cross-site Scripting (XSS) - Stored in microweber/microweber

HIGH 68

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00555 Published 2022-12-22 Fixed in 1.3.2 CWE-79

TI-2022-04220 CVE-2022-4617 · GHSA-3mmh-vq9w-4c3g

Cross-site Scripting (XSS) - Reflected in microweber/microweber

HIGH 68

Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00659 Published 2022-12-21 Fixed in 1.3.2 CWE-79

TI-2022-02998 CVE-2022-3245 · GHSA-gm8c-w9cm-c445

Code Injection in display of tag title on saving tags in microweber/microweber

HIGH 68

HTML injection attack is closely related to Cross-site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00739 Published 2022-09-20 Fixed in 1.3.2 CWE-94

TI-2025-32352 CVE-2025-51504 · GHSA-2x2j-3c2v-g3c2

Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile…

HIGH 66

Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00595 Published 2025-08-01 No fix listed CWE-79

TI-2025-32351 CVE-2025-51503 · GHSA-782f-gxj5-xvqc

A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers…

HIGH 66

A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00577 Published 2025-07-31 No fix listed CWE-79

TI-2022-04328 CVE-2022-4732 · GHSA-8h43-xg5g-9cj7

Unrestricted Upload of File with Dangerous Type in microweber/microweber

HIGH 65

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.38236 Published 2022-12-24 Fixed in 1.3.2 CWE-434

TI-2024-38386 CVE-2024-58289 · GHSA-mhwg-hvw8-9w84

Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields

MEDIUM 63

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00261 Published 2025-12-11 No fix listed CWE-79

TI-2022-00476 CVE-2022-0557 · GHSA-vm37-j55j-8655

OS Command Injection in microweber/microweber

MEDIUM 63

OS Command Injection in Packagist microweber/microweber prior to 1.2.11.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.51193 Published 2022-02-11 Fixed in 1.2.11 CWE-78

TI-2023-02099 CVE-2023-2239 · GHSA-h83h-77x2-6w6g

Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweber

MEDIUM 62

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00504 Published 2023-04-22 Fixed in 1.3.4 CWE-359

TI-2022-00581 CVE-2022-0666 · GHSA-3wwj-wh2w-g4xp

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at…

MEDIUM 62

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.44259 Published 2022-02-18 Fixed in 1.2.11 CWE-93

TI-2025-43131 CVE-2025-70792 · GHSA-6w5w-jx4x-vjvw

Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber…

MEDIUM 60

Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00311 Published 2026-02-05 Fixed in 2.0.20 CWE-79

TI-2025-43130 CVE-2025-70791 · GHSA-5jg5-xqfw-rv92

Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber…

MEDIUM 60

Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00308 Published 2026-02-05 Fixed in 2.0.20 CWE-79

TI-2025-24243 CVE-2025-34076 · GHSA-j64v-xh5w-8hqj

Microweber CMS Authenticated Local File Inclusion via Backup API

MEDIUM 60

An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.02291 Published 2025-07-02 Fixed in 1.2.11 CWE-22

TI-2024-27619 CVE-2024-41381 · GHSA-h4xf-wx99-jmv4

microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability…

MEDIUM 60

microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00307 Published 2024-08-05 No fix listed CWE-79

TI-2024-27618 CVE-2024-41380 · GHSA-hf66-xfgj-42g8

microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability…

MEDIUM 60

microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00307 Published 2024-08-05 No fix listed CWE-79

TI-2024-22007 CVE-2024-33298 · GHSA-w5g5-4jj3-8f6v

Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote…

MEDIUM 60

Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00884 Published 2025-01-10 No fix listed CWE-79

TI-2023-04821 CVE-2023-5244 · GHSA-rgf9-j7gv-rq22

Cross-site Scripting (XSS) - Reflected in microweber/microweber

MEDIUM 60

Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01122 Published 2023-09-28 Fixed in 2.0 CWE-79

TI-2023-01767 CVE-2023-1881 · GHSA-hhjm-mpmf-cxg9

Cross-site Scripting (XSS) - Stored in microweber/microweber

MEDIUM 60

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00493 Published 2023-04-05 Fixed in 1.3.3 CWE-79

TI-2022-02995 CVE-2022-3242 · GHSA-232p-59mg-f98p

HTML code Injection in template search keyword in microweber/microweber

MEDIUM 60

Code Injection in GitHub repository microweber/microweber prior to 1.3.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01946 Published 2022-09-20 Fixed in 1.3.2 CWE-94

TI-2022-00612 CVE-2022-0698 · GHSA-79gx-3fm8-qxqq

Cross-site scripting in Microweber

MEDIUM 60

Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0074 Published 2022-11-25 No fix listed CWE-79

Open these records in search →