Priority MEDIUM 60
Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00311 · Published 2026-02-05 · Fixed in 2.0.20 CWE-79
Priority MEDIUM 60
Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00308 · Published 2026-02-05 · Fixed in 2.0.20 CWE-79
Priority MEDIUM 63
Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00261 · Published 2025-12-11 · No fix listed CWE-79
Priority HIGH 69
Microweber CMS 2.0 has Weak Password Requirements.
CVSS 3.1HIGH 8.3· Network · No auth · User interaction · EPSS 0.00458 · Published 2025-10-24 · No fix listed CWE-521
Priority HIGH 66
Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00595 · Published 2025-08-01 · No fix listed CWE-79
Priority LOW 29
Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00897 · Published 2025-08-01 · No fix listed CWE-79
Priority LOW 29
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00902 · Published 2025-08-01 · No fix listed CWE-79
Priority HIGH 66
A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00577 · Published 2025-07-31 · No fix listed CWE-79
Priority MEDIUM 60
An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API.
CVSS 4.0MEDIUM 6.1· Network · Low privileges · No interaction · EPSS 0.02291 · Published 2025-07-02 · Fixed in 1.2.11 CWE-22
Priority MEDIUM 56
A vulnerability was found in Microweber 2.0.19.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.0052 · Published 2025-03-11 · No fix listed CWE-79
Priority MEDIUM 57
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users
CVSS 3.1MEDIUM 4.7· Network · High privileges · No interaction · EPSS 0.01156 · Published 2025-01-10 · No fix listed CWE-79
Priority MEDIUM 60
Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00884 · Published 2025-01-10 · No fix listed CWE-79
Priority MEDIUM 57
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function
CVSS 3.1MEDIUM 4.7· Network · High privileges · No interaction · EPSS 0.01156 · Published 2025-01-10 · No fix listed CWE-79
Priority LOW 39
A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.
CVSS 3.1HIGH 7.2· Network · No auth · No interaction · EPSS 0.00903 · Published 2024-08-06 · Fixed in 2.0.16 CWE-79
Priority MEDIUM 60
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00307 · Published 2024-08-05 · No fix listed CWE-79
Priority MEDIUM 60
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00307 · Published 2024-08-05 · No fix listed CWE-79
Priority MEDIUM 55
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00512 · Published 2023-12-15 · Fixed in 2.0, 2.0.0 CWE-840
Priority LOW 21
Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.0049 · Published 2023-12-08 · Fixed in 2.0, 2.0.0 CWE-544
Priority LOW 34
An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00846 · Published 2023-12-08 · Fixed in 2.0.4 CWE-200
Priority LOW 29
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00487 · Published 2023-12-07 · Fixed in 2.0, 2.0.0 CWE-840
Priority MEDIUM 43
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.02457 · Published 2023-11-30 · No fix listed CWE-434
Priority LOW 25
Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0051 · Published 2023-11-08 · Fixed in 2.0.3 CWE-79
Priority MEDIUM 53
Improper Access Control in GitHub repository microweber/microweber prior to 2.0.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00394 · Published 2023-11-07 · Fixed in 2.0, 2.0.0 CWE-284
Priority MEDIUM 55
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00503 · Published 2023-10-31 · Fixed in 2.0, 2.0.0 CWE-79
Priority HIGH 72
Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00653 · Published 2023-09-30 · Fixed in 2.0 CWE-798
Load more
THREATIST.IORead the docs