Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
78 results · page 1 of 2
Dec 14, 2023Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6832 · Other software · microweber · reported by security@huntr.devMedium 4.3
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6599 · Other software · microweber · reported by security@huntr.devMedium 4.3
Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2023Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6566 · Other software · microweber · reported by security@huntr.devMedium 6.5
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Improper Access Control in GitHub repository microweber/microweber prior to 2.0.CVE-2023-5976 · Other software · microweber · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.CVE-2023-5861 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.CVE-2023-5318 · Other software · microweber · reported by security@huntr.devHigh 7.5
Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.CVE-2023-5244 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.CVE-2023-3142 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2023Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.CVE-2023-2239 · Other software · microweber · reported by security@huntr.devMedium 6.5
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.CVE-2023-2240 · Other software · microweber · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-2014 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-1881 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Command Injection in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-1877 · Other software · microweber · reported by security@huntr.devCritical 9.8
Command Injection in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-1081 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.CVE-2023-0608 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-4732 · Other software · microweber · reported by security@huntr.devHigh 7.2
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-4647 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-4617 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022HTML injection attack is closely related to Cross-site Scripting (XSS).CVE-2022-3245 · Other software · microweber · reported by security@huntr.devMedium 6.1
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Code Injection in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-3242 · Other software · microweber · reported by security@huntr.devMedium 6.1
Code Injection in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.CVE-2022-2777 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-2470 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-2495 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2022Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.CVE-2022-2368 · Other software · microweber · reported by security@huntr.devMedium 6.5
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2022Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch conteCVE-2022-2353 · Other software · microweber · reported by security@huntr.devMedium 6.1
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-2300 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-2280 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-2252 · Other software · microweber · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.CVE-2022-2174 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.CVE-2022-2130 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2022Users Account Pre-Takeover or Users Account Takeover.CVE-2022-1631 · Other software · microweber · reported by security@huntr.devHigh 8.8
Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain pre-authentication to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing. Hence, the attacker’s persistence will remain. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor. This attack becomes more interesting when an attacker can register an account from an employee’s email address. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 4, 2022Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16.CVE-2022-1584 · Other software · microweber · reported by security@huntr.devMedium 6.1
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16.CVE-2022-1555 · Other software · microweber · reported by security@huntr.devMedium 6.1
DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2022XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15.CVE-2022-1504 · Other software · microweber · reported by security@huntr.devMedium 6.1
XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2022Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15.CVE-2022-1439 · Other software · microweber · reported by security@huntr.devMedium 6.1
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2022Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-1036 · Other software · microweber · reported by security@huntr.devHigh 7.5
Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) CVE-2022-0968 · Other software · microweber · reported by security@huntr.devMedium 5.5
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0963 · Other software · microweber · reported by security@huntr.devMedium 5.4
Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a CVE-2022-0961 · Other software · microweber · reported by security@huntr.devMedium 5.5
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub reCVE-2022-0954 · Other software · microweber · reported by security@huntr.devMedium 5.4
Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2022File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0930 · Other software · microweber · reported by security@huntr.devMedium 4.8
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2022XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.CVE-2022-0929 · Other software · microweber · reported by security@huntr.devMedium 6.1
XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2022File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0926 · Other software · microweber · reported by security@huntr.devMedium 4.8
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0921 · Other software · microweber · reported by security@huntr.devMedium 6.7
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-0928 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0913 · Other software · microweber · reported by security@huntr.devHigh 7.5
Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.CVE-2022-0912 · Other software · microweber · reported by security@huntr.devMedium 4.8
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.CVE-2022-0906 · Other software · microweber · reported by security@huntr.devMedium 4.8
Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Static Code Injection in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0895 · Other software · microweber · reported by security@huntr.devCritical 9.8
Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0896 · Other software · microweber · reported by security@huntr.devHigh 8.8
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.