Read the docs
TI-2022-02998 Aliases CVE-2022-3245GHSA-gm8c-w9cm-c445

Code Injection in display of tag title on saving tags in microweber/microweber

Priority HIGH 68CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94 and CWE-79.

Summary

HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00739 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed microweber/microweber (microweber): 1.3.2microweber/microweber (Packagist): 1.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
microwebermicroweber/microweberbefore 1.3.21.3.2Patch availableCNA
—microweber/microweber (Packagist)before 1.3.21.3.2Patch availableGHSA-gm8c-w9cm-c445
  • microweber/microweber Vendormicroweber Affected before 1.3.2 Fixed in 1.3.2 Patch available CNA
  • microweber/microweber (Packagist) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-gm8c-w9cm-c445

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*before 1.3.2Vulnerablemicroweber
  • cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* Versions before 1.3.2 Vulnerable ·microweber

Remediation

  • Fix · CNA microweber/microweber (microweber) Fixed in 1.3.2
  • Fix · GHSA-gm8c-w9cm-c445 microweber/microweber (Packagist) Fixed in 1.3.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    microweber/microweber 1.3.2

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2022-02995 HTML code Injection in template search keyword in microweber/microweberPriority MEDIUM 60
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3245
  2. 2026-10-03 Alias added: GHSA-gm8c-w9cm-c445

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2023-01763 Command Injection in microweber/microweber CVSS 3.1CRITICAL 9.8
  • TI-2023-02100 Improper Privilege Management in microweber/microweber CVSS 3.1HIGH 8.8
  • TI-2022-14518 Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. CVSS 3.1HIGH 8.8
  • TI-2023-04891 Use of Hard-coded Credentials in microweber/microweber CVSS 3.1HIGH 7.5
  • TI-2025-37870 Microweber CMS 2.0 has Weak Password Requirements. CVSS 3.1HIGH 8.3
  • TI-2022-04247 Cross-site Scripting (XSS) - Stored in microweber/microweber CVSS 3.1MEDIUM 6.1
See all 113 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences