# cve.now: Microweber

The newest entries naming Microweber as an affected vendor (up to 200), of 87 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-5696](https://cve.now/CVE-2026-5696.md): Multiple vulnerabilities in the Microweber administration panel (CVSS 5.9)
- [CVE-2026-5695](https://cve.now/CVE-2026-5695.md): Multiple vulnerabilities in the Microweber administration panel (CVSS 8.4)
- [CVE-2026-67617](https://cve.now/CVE-2026-67617.md): Microweber CMS 2.0.20 Stored XSS via tag\_names Parameter (CVSS 4.8)
- [CVE-2026-65693](https://cve.now/CVE-2026-65693.md): Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates (CVSS 8.6)
- [CVE-2026-65694](https://cve.now/CVE-2026-65694.md): Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController (CVSS 8.7)
- [CVE-2024-58289](https://cve.now/CVE-2024-58289.md): Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields (CVSS 5.3)
- [CVE-2025-34076](https://cve.now/CVE-2025-34076.md): Microweber CMS Authenticated Local File Inclusion via Backup API (CVSS 6.1)
- [CVE-2023-6832](https://cve.now/CVE-2023-6832.md): Business Logic Errors in microweber/microweber (CVSS 6.0)
- [CVE-2023-6599](https://cve.now/CVE-2023-6599.md): Missing Standardized Error Handling Mechanism in microweber/microweber (CVSS 3.1)
- [CVE-2023-6566](https://cve.now/CVE-2023-6566.md): Business Logic Errors in microweber/microweber (CVSS 5.9)
- [CVE-2023-5976](https://cve.now/CVE-2023-5976.md): Improper Access Control in microweber/microweber (CVSS 4.6)
- [CVE-2023-5861](https://cve.now/CVE-2023-5861.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.4)
- [CVE-2023-5318](https://cve.now/CVE-2023-5318.md): Use of Hard-coded Credentials in microweber/microweber (CVSS 5.8)
- [CVE-2023-5244](https://cve.now/CVE-2023-5244.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 5.0)
- [CVE-2023-3142](https://cve.now/CVE-2023-3142.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 3.8)
- [CVE-2023-2240](https://cve.now/CVE-2023-2240.md): Improper Privilege Management in microweber/microweber (CVSS 8.8)
- [CVE-2023-2239](https://cve.now/CVE-2023-2239.md): Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweber (CVSS 7.1)
- [CVE-2023-2014](https://cve.now/CVE-2023-2014.md): Cross-site Scripting (XSS) - Generic in microweber/microweber (CVSS 5.3)
- [CVE-2023-1881](https://cve.now/CVE-2023-1881.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 7.4)
- [CVE-2023-1877](https://cve.now/CVE-2023-1877.md): Command Injection in microweber/microweber (CVSS 6.1)
- [CVE-2023-1081](https://cve.now/CVE-2023-1081.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 5.7)
- [CVE-2021-32857](https://cve.now/CVE-2021-32857.md): Cockpit vulnerable to Cross-site Scripting (CVSS 6.1)
- [CVE-2021-32856](https://cve.now/CVE-2021-32856.md): Microweber vulnerable to Cross-site Scripting (CVSS 6.1)
- [CVE-2023-0608](https://cve.now/CVE-2023-0608.md): Cross-site Scripting (XSS) - DOM in microweber/microweber (CVSS 6.3)
- [CVE-2022-4732](https://cve.now/CVE-2022-4732.md): Unrestricted Upload of File with Dangerous Type in microweber/microweber (CVSS 4.7)
- [CVE-2022-4647](https://cve.now/CVE-2022-4647.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 5.1)
- [CVE-2022-4617](https://cve.now/CVE-2022-4617.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 2.7)
- [CVE-2022-3245](https://cve.now/CVE-2022-3245.md): Code Injection in display of tag title on saving tags in microweber/microweber (CVSS 4.3)
- [CVE-2022-3242](https://cve.now/CVE-2022-3242.md): HTML code Injection in template search keyword in microweber/microweber (CVSS 4.3)
- [CVE-2022-2777](https://cve.now/CVE-2022-2777.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.6)
- [CVE-2022-2470](https://cve.now/CVE-2022-2470.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 6.5)
- [CVE-2022-2495](https://cve.now/CVE-2022-2495.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.8)
- [CVE-2022-2368](https://cve.now/CVE-2022-2368.md): Authentication Bypass by Spoofing in microweber/microweber (CVSS 6.5)
- [CVE-2022-2353](https://cve.now/CVE-2022-2353.md): Cross-Site Request Forgery (CSRF) in microweber/microweber (CVSS 6.3)
- [CVE-2022-2300](https://cve.now/CVE-2022-2300.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.3)
- [CVE-2022-2280](https://cve.now/CVE-2022-2280.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.5)
- [CVE-2022-2252](https://cve.now/CVE-2022-2252.md): Open Redirect in microweber/microweber (CVSS 4.3)
- [CVE-2022-2174](https://cve.now/CVE-2022-2174.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 6.5)
- [CVE-2022-2130](https://cve.now/CVE-2022-2130.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 6.5)
- [CVE-2022-1631](https://cve.now/CVE-2022-1631.md): Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber (CVSS 6.8)
- [CVE-2022-1584](https://cve.now/CVE-2022-1584.md): Reflected XSS in microweber/microweber (CVSS 6.3)
- [CVE-2022-1555](https://cve.now/CVE-2022-1555.md): DOM XSS in microweber ver 1.2.15 in microweber/microweber (CVSS 8.8)
- [CVE-2022-1504](https://cve.now/CVE-2022-1504.md): XSS in /demo/module/?module=HERE in microweber/microweber (CVSS 6.3)
- [CVE-2022-1439](https://cve.now/CVE-2022-1439.md): Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber (CVSS 6.3)
- [CVE-2022-1036](https://cve.now/CVE-2022-1036.md): Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber (CVSS 5.3)
- [CVE-2022-0968](https://cve.now/CVE-2022-0968.md): The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber (CVSS 7.2)
- [CVE-2022-0963](https://cve.now/CVE-2022-0963.md): Unrestricted XML Files Leads to Stored XSS in microweber/microweber (CVSS 5.7)
- [CVE-2022-0961](https://cve.now/CVE-2022-0961.md): The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber (CVSS 7.1)
- [CVE-2022-0954](https://cve.now/CVE-2022-0954.md): Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in microweber/microweber (CVSS 6.8)
- [CVE-2022-0930](https://cve.now/CVE-2022-0930.md): File upload filter bypass leading to stored XSS in microweber/microweber (CVSS 8.0)
- [CVE-2022-0929](https://cve.now/CVE-2022-0929.md): XSS on dynamic\_text module in microweber/microweber (CVSS 6.8)
- [CVE-2022-0926](https://cve.now/CVE-2022-0926.md): File upload filter bypass leading to stored XSS in microweber/microweber (CVSS 7.1)
- [CVE-2022-0921](https://cve.now/CVE-2022-0921.md): Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber (CVSS 7.2)
- [CVE-2022-0928](https://cve.now/CVE-2022-0928.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.8)
- [CVE-2022-0912](https://cve.now/CVE-2022-0912.md): Unrestricted Upload of File with Dangerous Type in microweber/microweber (CVSS 4.8)
- [CVE-2022-0913](https://cve.now/CVE-2022-0913.md): Integer Overflow or Wraparound in microweber/microweber (CVSS 9.1)
- [CVE-2022-0906](https://cve.now/CVE-2022-0906.md): Unrestricted file upload leads to stored XSS in microweber/microweber (CVSS 4.3)
- [CVE-2022-0895](https://cve.now/CVE-2022-0895.md): Static Code Injection in microweber/microweber (CVSS 7.7)
- [CVE-2022-0896](https://cve.now/CVE-2022-0896.md): Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber (CVSS 7.1)
- [CVE-2022-0777](https://cve.now/CVE-2022-0777.md): Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber (CVSS 7.3)
- [CVE-2022-0723](https://cve.now/CVE-2022-0723.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 8.0)
- [CVE-2022-0763](https://cve.now/CVE-2022-0763.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 4.3)
- [CVE-2022-0762](https://cve.now/CVE-2022-0762.md): Incorrect Authorization in microweber/microweber (CVSS 5.5)
- [CVE-2022-0724](https://cve.now/CVE-2022-0724.md): Insecure Storage of Sensitive Information in microweber/microweber (CVSS 9.1)
- [CVE-2022-0721](https://cve.now/CVE-2022-0721.md): Insertion of Sensitive Information Into Debugging Code in microweber/microweber (CVSS 8.8)
- [CVE-2022-0719](https://cve.now/CVE-2022-0719.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 7.6)
- [CVE-2022-0688](https://cve.now/CVE-2022-0688.md): Business Logic Errors in microweber/microweber (CVSS 9.4)
- [CVE-2022-0690](https://cve.now/CVE-2022-0690.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 8.8)
- [CVE-2022-0689](https://cve.now/CVE-2022-0689.md): Use multiple time the one-time coupon in microweber/microweber (CVSS 5.3)
- [CVE-2022-0678](https://cve.now/CVE-2022-0678.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 6.5)
- [CVE-2022-0666](https://cve.now/CVE-2022-0666.md): CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber (CVSS 7.6)
- [CVE-2022-0660](https://cve.now/CVE-2022-0660.md): Generation of Error Message Containing Sensitive Information in microweber/microweber (CVSS 9.4)
- [CVE-2022-0638](https://cve.now/CVE-2022-0638.md): Cross-Site Request Forgery (CSRF) in microweber/microweber (CVSS 4.3)
- [CVE-2022-0597](https://cve.now/CVE-2022-0597.md): Open Redirect in microweber/microweber (CVSS 4.3)
- [CVE-2022-0596](https://cve.now/CVE-2022-0596.md): Improper Validation of Specified Quantity in Input in microweber/microweber (CVSS 5.4)
- [CVE-2022-0560](https://cve.now/CVE-2022-0560.md): Open Redirect in microweber/microweber (CVSS 4.3)
- [CVE-2022-0557](https://cve.now/CVE-2022-0557.md): OS Command Injection in microweber/microweber (CVSS 8.1)
- [CVE-2022-0558](https://cve.now/CVE-2022-0558.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 9.8)
- [CVE-2022-0504](https://cve.now/CVE-2022-0504.md): Generation of Error Message Containing Sensitive Information in microweber/microweber (CVSS 6.5)
- [CVE-2022-0505](https://cve.now/CVE-2022-0505.md): Cross-Site Request Forgery (CSRF) in microweber/microweber (CVSS 5.7)
- [CVE-2022-0506](https://cve.now/CVE-2022-0506.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 7.7)
- [CVE-2022-0378](https://cve.now/CVE-2022-0378.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 7.1)
- [CVE-2022-0379](https://cve.now/CVE-2022-0379.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 8.1)
- [CVE-2022-0282](https://cve.now/CVE-2022-0282.md): Cross-site Scripting in microweber/microweber (CVSS 4.3)
- [CVE-2022-0281](https://cve.now/CVE-2022-0281.md): Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber (CVSS 7.5)
- [CVE-2022-0278](https://cve.now/CVE-2022-0278.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 7.2)
- [CVE-2022-0277](https://cve.now/CVE-2022-0277.md): Incorrect Permission Assignment for Critical Resource in microweber/microweber (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/microweber
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.