Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
75 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Cross-site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
Recommended action: Upgrade to 2.0.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a Cross-site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "relid" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
Recommended action: Upgrade to 2.0.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authenticated local file inclusion vulnerability exists in Microweber CMS versions < 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.
Recommended action: Upgrade to 1.2.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.
Recommended action: Upgrade to 2.0.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability has been identified in microweber where users can purchase items with a coupon code. If the admin disables the use of the coupon code functionality, but the user sends requests to the API that handles the coupon code, the user can exploit the vulnerability and obtain items at a lower price.
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue present in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.
Recommended action: Upgrade to 2.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.0.
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.0. Unpublished and deleted product(s) can be added to checkout.
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Access Control in GitHub repository microweber/microweber prior to 2.0.0.
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microweber CMS prior to version 2.0.3 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.
Recommended action: Upgrade to 2.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
Recommended action: Upgrade to 1.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microweber prior to 1.3.4 has an Improper Privilege Management vulnerability.
Recommended action: Upgrade to 1.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
microweber/microweber prior to 1.3.3 is vulnerable to cross-site scripting (XSS) in the template selection while changing a group template.
Recommended action: Upgrade to 1.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
microweber/microweber prior to 1.3.3 is vulnerable to command injection in the "first name" field. This allows for server-side template injection, which can lead to arbitrary code execution.
Recommended action: Upgrade to 1.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
microweber/microweber prior to 1.3.3 is vulnerable to stored cross-site scripting (XSS) via the X-Forwarded-For header. This was fixed in version 1.3.3.
Recommended action: Upgrade to 1.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
Recommended action: Upgrade to 1.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
Recommended action: Upgrade to 1.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microweber versions 1.3.1 and prior are vulnerable to HTML injection that an attacker can use to redirect someone to a malicious site. A patch is available at commit 68f0721571653db865a5fa01c7986642c82e919c and expected to be part of version 1.3.2.
Recommended action: Upgrade to 1.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit f20abf30a1d9c1426c5fb757ac63998dc5b92bfc and is anticipated to be part of version 1.3.2.
Recommended action: Upgrade to 1.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Microweber prior to v1.3.1, the title parameter in the body of POST request when creating/editing a category is vulnerable to stored cross-site scripting.
Recommended action: Upgrade to 1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microwerber prior to version 1.2.20 is vulnerable to stored Cross-site Scripting (XSS).
Recommended action: Upgrade to 1.2.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microweber prior to 1.2.21 is vulnerable to reflected cross-site scripting (XSS).
Recommended action: Upgrade to 1.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the login API, an IP address will by default be blocked when the user tries to login incorrectly more than 5 times. However, a bypass to this mechanism is possible by abusing a X-Forwarded-For header to bypass IP detection and perform a password brute-force. A patch for this issue is available in Microweber version 1.2.21.
Recommended action: Upgrade to 1.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Prior to Microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery (CSRF), fetch contents from same-site and redirect a user.
Recommended action: Upgrade to 1.2.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.