Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
122 results · page 2 of 3
Jul 22, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-2470 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-2495 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2022An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictureCVE-2021-36461 · Other software · Microweber · reported by MITREHigh 8.8
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2022Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.CVE-2022-2368 · Other software · microweber · reported by security@huntr.devMedium 6.5
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2022Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch conteCVE-2022-2353 · Other software · microweber · reported by security@huntr.devMedium 6.1
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-2300 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-2280 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-2252 · Other software · microweber · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.CVE-2022-2174 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.CVE-2022-2130 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2022Users Account Pre-Takeover or Users Account Takeover.CVE-2022-1631 · Other software · microweber · reported by security@huntr.devHigh 8.8
Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain pre-authentication to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing. Hence, the attacker’s persistence will remain. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor. This attack becomes more interesting when an attacker can register an account from an employee’s email address. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 4, 2022Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16.CVE-2022-1584 · Other software · microweber · reported by security@huntr.devMedium 6.1
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16.CVE-2022-1555 · Other software · microweber · reported by security@huntr.devMedium 6.1
DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2022XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15.CVE-2022-1504 · Other software · microweber · reported by security@huntr.devMedium 6.1
XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2022Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15.CVE-2022-1439 · Other software · microweber · reported by security@huntr.devMedium 6.1
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2022Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-1036 · Other software · microweber · reported by security@huntr.devHigh 7.5
Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) CVE-2022-0968 · Other software · microweber · reported by security@huntr.devMedium 5.5
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0963 · Other software · microweber · reported by security@huntr.devMedium 5.4
Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a CVE-2022-0961 · Other software · microweber · reported by security@huntr.devMedium 5.5
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub reCVE-2022-0954 · Other software · microweber · reported by security@huntr.devMedium 5.4
Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2022File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0930 · Other software · microweber · reported by security@huntr.devMedium 4.8
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2022XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.CVE-2022-0929 · Other software · microweber · reported by security@huntr.devMedium 6.1
XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2022File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0926 · Other software · microweber · reported by security@huntr.devMedium 4.8
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0921 · Other software · microweber · reported by security@huntr.devMedium 6.7
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0928 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0913 · Other software · microweber · reported by security@huntr.devHigh 7.5
Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.CVE-2022-0912 · Other software · microweber · reported by security@huntr.devMedium 4.8
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.CVE-2022-0906 · Other software · microweber · reported by security@huntr.devMedium 4.8
Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Static Code Injection in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0895 · Other software · microweber · reported by security@huntr.devCritical 9.8
Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0896 · Other software · microweber · reported by security@huntr.devHigh 8.8
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2022Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.CVE-2022-0855 · Other software · microweber-dev · reported by security@huntr.devMedium 6.1
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.
- Product
- microweber-dev/whmcs_plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0777 · Other software · microweber · reported by security@huntr.devHigh 7.5
Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.CVE-2022-0723 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0763 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2022Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0762 · Other software · microweber · reported by security@huntr.devMedium 5.5
Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2022Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0724 · Other software · microweber · reported by security@huntr.devMedium 6.5
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2022Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0721 · Other software · microweber · reported by security@huntr.devMedium 6.5
Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0719 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0688 · Other software · microweber · reported by security@huntr.devMedium 4.9
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0690 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0689 · Other software · microweber · reported by security@huntr.devMedium 5.3
Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0678 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0666 · Other software · microweber · reported by security@huntr.devHigh 7.5
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0660 · Other software · microweber · reported by security@huntr.devHigh 7.5
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2022Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0638 · Other software · microweber · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Open Redirect in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0597 · Other software · microweber · reported by security@huntr.devMedium 6.1
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0596 · Other software · microweber · reported by security@huntr.devMedium 4.3
Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Open Redirect in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0560 · Other software · microweber · reported by security@huntr.devMedium 6.1
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022OS Command Injection in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0557 · Other software · microweber · reported by security@huntr.devHigh 7.2
OS Command Injection in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 10, 2022Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0558 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.