Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
122 results · page 3 of 3
Feb 8, 2022Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0506 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0505 · Other software · microweber · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0504 · Other software · microweber · reported by security@huntr.devMedium 6.5
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0379 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0378 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0282 · Other software · microweber · reported by security@huntr.devMedium 4.3
Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0281 · Other software · microweber · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0278 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0277 · Other software · microweber · reported by security@huntr.devMedium 6.5
Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021Cross Site Scripting (XSS).CVE-2021-33988 · Other software · Microweber · reported by MITREMedium 6.1
Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting code in the request form.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2021A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backupCVE-2020-28337 · Other software · Microweber · reported by MITREHigh 7.2
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 9, 2020Microweber 1.1.18 is affected by insufficient session expiration.CVE-2020-23140 · Other software · Microweber · reported by MITREHigh 8.1
Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 9, 2020Microweber 1.1.18 is affected by broken authentication and session management.CVE-2020-23139 · Other software · Microweber · reported by MITREMedium 5.5
Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 9, 2020An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page.CVE-2020-23138 · Other software · Microweber · reported by MITRECritical 9.8
An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension (eg- .exe) to the web server by providing image data and the image/jpeg content type with a .php extension.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 9, 2020Microweber v1.1.18 is affected by no session expiry after log-out.CVE-2020-23136 · Other software · Microweber · reported by MITREMedium 5.5
Microweber v1.1.18 is affected by no session expiry after log-out.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 16, 2020userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POSTCVE-2020-13405 · Other software · Microweber · reported by MITREHigh 7.5
userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrhinosecuritylabs.com
May 20, 2020Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with thCVE-2020-13241 · Other software · Microweber · reported by MITREHigh 7.8
Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 21, 2019Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.CVE-2018-19917 · Other software · Microweber · reported by MITREMedium 6.1
Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 20, 2018Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.CVE-2018-1000826 · Other software · Microweber · reported by MITREMedium 6.1
Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2018An issue was discovered in Microweber 1.0.7.CVE-2018-17104 · Other software · Microweber · reported by MITREHigh 8.8
An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2015SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute arbitrary SQL commands via the category paCVE-2014-9464 · Other software · Microweber · reported by MITREHigh 7.5
SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute arbitrary SQL commands via the category parameter when displaying a category, related to the $parent_id variable.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2014Directory traversal vulnerability in userfiles/modules/admin/backup/delete.php in Microweber before 0.830 allows remote attackers to delete arbitrary files via CVE-2013-5984 · Other software · Microweber · reported by MITREMedium 6.4
Directory traversal vulnerability in userfiles/modules/admin/backup/delete.php in Microweber before 0.830 allows remote attackers to delete arbitrary files via a .. (dot dot) in the file parameter.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.