microweber vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-5695 Arbitrary file upload vulnerability due to a lack of proper validation in upload forms.High 8.4 · Sep 23, 2026
• CVE-2026-65693 Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command eHigh 8.6 · Jul 24, 2026
• CVE-2026-65694 Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitraHigh 8.7 · Jul 23, 2026
• CVE-2025-60954 Microweber CMS 2.0 has Weak Password Requirements.High 8.3 · Oct 24, 2025
• CVE-2025-51504 Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.High 7.6 · Aug 1, 2025
• CVE-2025-51503 A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrHigh 7.6 · Jul 31, 2025
• CVE-2023-48122 An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.High 7.5 · Dec 7, 2023
• CVE-2023-49052 File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the creatHigh 8.8 · Nov 30, 2023
• CVE-2023-5318 Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.High 7.5 · Sep 29, 2023
• CVE-2023-2240 Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.High 8.8 · Apr 21, 2023
• CVE-2023-1877 Command Injection in GitHub repository microweber/microweber prior to 1.3.3.Critical 9.8 · Apr 5, 2023
• CVE-2022-4732 Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.High 7.2 · Dec 27, 2022
• CVE-2022-33012 Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.High 8.8 · Nov 22, 2022
• CVE-2021-36461 An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictureHigh 8.8 · Jul 15, 2022
• CVE-2022-1631 Users Account Pre-Takeover or Users Account Takeover.High 8.8 · May 9, 2022
• CVE-2022-1036 Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.High 7.5 · Mar 22, 2022
• CVE-2022-0913 Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.High 7.5 · Mar 11, 2022
• CVE-2022-0895 Static Code Injection in GitHub repository microweber/microweber prior to 1.3.Critical 9.8 · Mar 10, 2022
• CVE-2022-0896 Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.High 8.8 · Mar 9, 2022
• CVE-2022-0777 Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.High 7.5 · Mar 1, 2022
• CVE-2022-0666 CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.High 7.5 · Feb 18, 2022
• CVE-2022-0660 Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.High 7.5 · Feb 18, 2022
• CVE-2022-0557 OS Command Injection in Packagist microweber/microweber prior to 1.2.11.High 7.2 · Feb 11, 2022
• CVE-2022-0281 Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.High 7.5 · Jan 20, 2022
• CVE-2020-28337 A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backupHigh 7.2 · Feb 15, 2021