Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

microweber/microweber

106 known vulnerabilities (5 critical, 27 high, 61 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
106 · 5 critical, 27 high, 61 medium, 3 low
Registry
Packagist

Advisories 106

  • CVE-2026-12198Medium 6.9

    Microweber API Endpoint thumbnail_img userfiles_path path traversal

    Affected: through 2.0.20.

  • CVE-2025-70792Medium 6.1

    Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19.

    Affected: fixed in 2.0.20.

  • CVE-2025-70791Medium 6.1

    Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19.

    Affected: fixed in 2.0.20.

  • Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.

    Affected: from 2.0.0, through 2.0.19.

  • CVE-2025-51502Medium 6.1

    Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary…

    Affected: from 2.0.0, through 2.0.19.

  • CVE-2025-51501Medium 6.1

    Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows…

    Affected: from 2.0.0, through 2.0.19.

  • A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile…

    Affected: from 2.0.0, through 2.0.19.

  • CVE-2025-34076Medium 6.1

    Microweber CMS Authenticated Local File Inclusion via Backup API

    Affected: fixed in 1.2.11.

  • CVE-2025-2214Medium 5.1

    Microweber Settings index.php cross site scripting

    Affected: through 2.0.19.

  • CVE-2024-33299Medium 4.7

    Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last…

    Affected: through 2.0.9.

  • CVE-2024-33298Medium 6.1

    Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new…

    Affected: through 2.0.9.

  • CVE-2024-33297Medium 4.7

    Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name…

    Affected: through 2.0.9.

  • A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote…

    Affected: fixed in 2.0.16.

  • CVE-2024-41381Medium 6.1

    microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.

    Affected: through 2.0.16.

  • CVE-2024-41380Medium 6.1

    microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.

    Affected: through 2.0.16.

Show all 106 advisoriesShow fewer advisories
  • CVE-2023-6832Medium 6.0

    Business Logic Errors in microweber/microweber

    Affected: fixed in 2.0.0.

  • Missing Standardized Error Handling Mechanism in microweber/microweber

    Affected: fixed in 2.0.0.

  • An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.

    Affected: from 2.0.1, fixed in 2.0.4.

  • CVE-2023-6566Medium 5.9

    Business Logic Errors in microweber/microweber

    Affected: fixed in 2.0.0.

  • File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload…

    Affected: through 2.0.4.

  • Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.

    Affected: fixed in 2.0.3.

  • CVE-2023-5976Medium 4.6

    Improper Access Control in microweber/microweber

    Affected: fixed in 2.0.0.

  • CVE-2023-5861Medium 6.4

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 2.0.0.

  • CVE-2023-5318Medium 5.8

    Use of Hard-coded Credentials in microweber/microweber

    Affected: through 1.3.4.

  • CVE-2023-5244Medium 5.0

    Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: through 1.3.4.

  • Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: through 1.3.4.

  • Improper Privilege Management in microweber/microweber

    Affected: fixed in 1.3.4.

  • Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweber

    Affected: fixed in 1.3.4.

  • CVE-2023-2014Medium 5.3

    Cross-site Scripting (XSS) - Generic in microweber/microweber

    Affected: fixed in 1.3.3.

  • Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.3.3.

  • CVE-2023-1877Medium 6.1

    Command Injection in microweber/microweber

    Affected: fixed in 1.3.3.

  • CVE-2023-1081Medium 5.7

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: through 1.3.2.

  • CVE-2021-32856Medium 6.1

    Microweber vulnerable to Cross-site Scripting

    Affected: through 1.2.12.

  • CVE-2023-0608Medium 6.3

    Cross-site Scripting (XSS) - DOM in microweber/microweber

    Affected: fixed in 1.3.2.

  • CVE-2022-4732Medium 4.7

    Unrestricted Upload of File with Dangerous Type in microweber/microweber

    Affected: fixed in 1.3.2.

  • CVE-2022-4647Medium 5.1

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: through 1.3.1.

  • Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: through 1.3.1.

  • CVE-2022-0698Medium 6.1

    Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.

    Affected: through 1.3.1.

  • Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.

    Affected: through 1.2.15.

  • CVE-2022-3245Medium 4.3

    Code Injection in display of tag title on saving tags in microweber/microweber

    Affected: fixed in 1.3.2.

  • CVE-2022-3242Medium 4.3

    HTML code Injection in template search keyword in microweber/microweber

    Affected: fixed in 1.3.2.

  • CVE-2022-2777Medium 6.6

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.3.1.

  • CVE-2022-2470Medium 6.5

    Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: fixed in 1.2.21.

  • CVE-2022-2495Medium 6.8

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.2.20.

  • CVE-2022-2368Medium 6.5

    Authentication Bypass by Spoofing in microweber/microweber

    Affected: fixed in 1.2.21.

  • CVE-2022-2353Medium 6.3

    Cross-Site Request Forgery (CSRF) in microweber/microweber

    Affected: fixed in 1.2.20.

  • CVE-2022-2300Medium 6.3

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.2.19.

  • CVE-2022-2280Medium 6.5

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.2.19.

  • CVE-2022-2252Medium 4.3

    Open Redirect in microweber/microweber

    Affected: fixed in 1.2.19.

  • CVE-2022-2174Medium 6.5

    Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: fixed in 1.2.18.

  • CVE-2022-2130Medium 6.5

    Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: through 1.2.17.

  • CVE-2022-1631Medium 6.8

    Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

    Affected: fixed in 1.2.15.

  • CVE-2022-1584Medium 6.3

    Reflected XSS in microweber/microweber

    Affected: fixed in 1.2.16.

  • DOM XSS in microweber ver 1.2.15 in microweber/microweber

    Affected: through 1.2.15.

  • CVE-2022-1504Medium 6.3

    XSS in /demo/module/?module=HERE in microweber/microweber

    Affected: fixed in 1.2.15.

  • CVE-2022-1439Medium 6.3

    Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber

    Affected: fixed in 1.2.15.

  • CVE-2022-1036Medium 5.3

    Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber

    Affected: fixed in 1.2.12.

  • The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a…

    Affected: through 1.2.11.

  • CVE-2022-0963Medium 5.7

    Unrestricted XML Files Leads to Stored XSS in microweber/microweber

    Affected: fixed in 1.2.12.

  • The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial…

    Affected: through 1.2.11.

  • CVE-2022-0954Medium 6.8

    Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops'…

    Affected: fixed in 1.2.12.

  • File upload filter bypass leading to stored XSS in microweber/microweber

    Affected: fixed in 1.2.12.

  • CVE-2022-0929Medium 6.8

    XSS on dynamic_text module in microweber/microweber

    Affected: fixed in 1.2.12.

  • File upload filter bypass leading to stored XSS in microweber/microweber

    Affected: fixed in 1.2.12.

  • Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber

    Affected: fixed in 1.2.12.

  • CVE-2022-0928Medium 6.8

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.2.12.

  • CVE-2022-0912Medium 4.8

    Unrestricted Upload of File with Dangerous Type in microweber/microweber

    Affected: fixed in 1.2.12.

  • CVE-2022-0913Critical 9.1

    Integer Overflow or Wraparound in microweber/microweber

    Affected: fixed in 1.2.12.

  • CVE-2022-0906Medium 4.3

    Unrestricted file upload leads to stored XSS in microweber/microweber

    Affected: fixed in 1.2.12.

  • Static Code Injection in microweber/microweber

    Affected: fixed in 1.3.

  • Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber

    Affected: fixed in 1.3.

  • Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber

    Affected: fixed in 1.3.

  • Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0763Medium 4.3

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.3.

  • CVE-2022-0762Medium 5.5

    Incorrect Authorization in microweber/microweber

    Affected: fixed in 1.3.0.

  • CVE-2022-0724Critical 9.1

    Insecure Storage of Sensitive Information in microweber/microweber

    Affected: fixed in 1.3.

  • Insertion of Sensitive Information Into Debugging Code in microweber/microweber

    Affected: fixed in 1.3.

  • Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: fixed in 1.3.

  • CVE-2022-0688Critical 9.4

    Business Logic Errors in microweber/microweber

    Affected: fixed in 1.2.11.

  • Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0689Medium 5.3

    Use multiple time the one-time coupon in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0678Medium 6.5

    Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: fixed in 1.2.11.

  • CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0660Critical 9.4

    Generation of Error Message Containing Sensitive Information in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0638Medium 4.3

    Cross-Site Request Forgery (CSRF) in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0597Medium 4.3

    Open Redirect in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0596Medium 5.4

    Improper Validation of Specified Quantity in Input in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0560Medium 4.3

    Open Redirect in microweber/microweber

    Affected: fixed in 1.2.11.

  • OS Command Injection in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0558Critical 9.8

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0504Medium 6.5

    Generation of Error Message Containing Sensitive Information in microweber/microweber

    Affected: through 1.2.10.

  • CVE-2022-0505Medium 5.7

    Cross-Site Request Forgery (CSRF) in microweber/microweber

    Affected: through 1.2.10.

  • Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: through 1.2.10.

  • Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Affected: fixed in 1.2.11.

  • Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0282Medium 4.3

    Cross-site Scripting in microweber/microweber

    Affected: fixed in 1.2.11.

  • Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber

    Affected: fixed in 1.2.11.

  • Cross-site Scripting (XSS) - Stored in microweber/microweber

    Affected: fixed in 1.2.11.

  • CVE-2022-0277Medium 6.5

    Incorrect Permission Assignment for Critical Resource in microweber/microweber

    Affected: fixed in 1.2.11.

  • Cross Site Scripting (XSS).

    Affected: fixed in 1.2.8.

  • A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code…

    Affected: fixed in 1.2.3.

  • Microweber v1.1.18 is affected by no session expiry after log-out.

    Affected: versions 1.1.18.

  • userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users…

    Affected: fixed in 1.1.20.

  • Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file…

    Affected: through 1.1.18.

  • Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.

    Affected: through 1.0.8.

  • Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution…

    Affected: fixed in 1.1.