Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
122 results · page 1 of 3
Sep 23, 2026Reflected Cross-Site Scripting (XSS) in Microweber.CVE-2026-5696 · Other software · Microweber · reported by cve-coordination@incibe.esMedium 5.9
Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.
- Product
- Administration panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Arbitrary file upload vulnerability due to a lack of proper validation in upload forms.CVE-2026-5695 · Other software · Microweber · reported by cve-coordination@incibe.esHigh 8.4
Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.
- Product
- Administration panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inCVE-2026-67617 · Other software · microweber · reported by VulnCheckMedium 4.8
Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls including XSS middleware that ignores GET requests, a strip_unsafe() function that only matches double-quoted onerror attributes, and a titlecase normalizer that passes HTML decimal entity-encoded payloads through unchanged. Attackers can store malicious scripts that execute without user interaction for every visitor to the public blog page and within the admin post editor, enabling session riding through same-origin fetch requests using the CSRF token embedded in the page.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 24, 2026Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command eCVE-2026-65693 · Other software · microweber · reported by VulnCheckHigh 8.6
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvulncheck.com
Jul 23, 2026Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitraCVE-2026-65694 · Other software · microweber · reported by VulnCheckHigh 8.7
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 14, 2026A weakness has been identified in Microweber up to 2.0.20.CVE-2026-12198 · Other software · reported by VulDBMedium 5.5
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19.CVE-2025-70792 · Other software · Microweber · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 5, 2026Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19.CVE-2025-70791 · Other software · Microweber · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 11, 2025Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields.CVE-2024-58289 · Other software · microweber · reported by VulnCheckMedium 5.3
Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commicroweber.me
Oct 24, 2025Microweber CMS 2.0 has Weak Password Requirements.CVE-2025-60954 · Other software · Microweber · reported by MITREHigh 8.3
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 1, 2025Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.CVE-2025-51504 · Other software · Microweber · reported by MITREHigh 7.6
Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the CVE-2025-51502 · Other software · Microweber · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScCVE-2025-51501 · Other software · Microweber · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrCVE-2025-51503 · Other software · Microweber · reported by MITREHigh 7.6
A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2025An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API.CVE-2025-34076 · Other software · Microweber Ltd. · reported by VulnCheckMedium 6.1
An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025A vulnerability was found in Microweber 2.0.19.CVE-2025-2214 · Other software · Microweber · reported by VulDBMedium 5.1
A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/website_group/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the eCVE-2024-33299 · Other software · Microweber · reported by MITREMedium 4.7
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in theCVE-2024-33298 · Other software · Microweber · reported by MITREMedium 6.1
Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the ACVE-2024-33297 · Other software · Microweber · reported by MITREMedium 4.7
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arCVE-2024-40101 · Other software · Microweber · reported by MITREMedium 6.1
A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Aug 5, 2024microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.CVE-2024-41381 · Other software · microweber · reported by MITREMedium 6.1
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.CVE-2024-41380 · Other software · microweber · reported by MITREMedium 6.1
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6832 · Other software · microweber · reported by security@huntr.devMedium 4.3
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.CVE-2023-48122 · Other software · Microweber · reported by MITREHigh 7.5
An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 7, 2023Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6599 · Other software · microweber · reported by security@huntr.devMedium 4.3
Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2023Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6566 · Other software · microweber · reported by security@huntr.devMedium 6.5
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the creatCVE-2023-49052 · Other software · Microweber · reported by MITREHigh 8.8
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.CVE-2023-47379 · Other software · Microweber · reported by MITREMedium 5.4
Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Improper Access Control in GitHub repository microweber/microweber prior to 2.0.CVE-2023-5976 · Other software · microweber · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.CVE-2023-5861 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.CVE-2023-5318 · Other software · microweber · reported by security@huntr.devHigh 7.5
Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.CVE-2023-5244 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.CVE-2023-3142 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2023Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.CVE-2023-2239 · Other software · microweber · reported by security@huntr.devMedium 6.5
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.CVE-2023-2240 · Other software · microweber · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-2014 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-1881 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Command Injection in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-1877 · Other software · microweber · reported by security@huntr.devCritical 9.8
Command Injection in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-1081 · Other software · microweber · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Cockpit is a content management system that allows addition of content management functionality to any site.CVE-2021-32857 · Other software · microweber · reported by GitHubMedium 6.1
Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Microweber is a drag and drop website builder and content management system.CVE-2021-32856 · Other software · microweber · reported by GitHubMedium 6.1
Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Feb 1, 2023Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.CVE-2023-0608 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-4732 · Other software · microweber · reported by security@huntr.devHigh 7.2
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-4647 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-4617 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.CVE-2022-0698 · Other software · Microweber · reported by help@fluidattacks.comMedium 6.1
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Nov 22, 2022Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.CVE-2022-33012 · Other software · Microweber · reported by MITREHigh 8.8
Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jitendrapatro.megithub.com
Sep 20, 2022HTML injection attack is closely related to Cross-site Scripting (XSS).CVE-2022-3245 · Other software · microweber · reported by security@huntr.devMedium 6.1
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Code Injection in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-3242 · Other software · microweber · reported by security@huntr.devMedium 6.1
Code Injection in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2022Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.CVE-2022-2777 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.