microweber Vulnerabilities and Affected Products
Vulnerabilities associated with microweber/microweber.
Products
Clear product- microweber/microweber78 vulnerabilities
- microweber10 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-6832MEDIUM | Business Logic Errors in microweber/microweberBusiness Logic Errors in GitHub repository microweber/microweber prior to 2.0. CWE-840Dec 15, 2023 | CVSS4.3v3.1 | EPSS0.512% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-6599MEDIUM | Missing Standardized Error Handling Mechanism in microweber/microweberMissing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0. | CVSS4.3v3.1 | EPSS0.49% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-6566MEDIUM | Business Logic Errors in microweber/microweberBusiness Logic Errors in GitHub repository microweber/microweber prior to 2.0. CWE-840Dec 7, 2023 | CVSS6.5v3.1 | EPSS0.487% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-5976MEDIUM | Improper Access Control in microweber/microweberImproper Access Control in GitHub repository microweber/microweber prior to 2.0. CWE-284Nov 7, 2023 | CVSS4.3v3.1 | EPSS0.394% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-5861MEDIUM | Cross-site Scripting (XSS) - Stored in microweber/microweberCross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0. CWE-79Oct 31, 2023 | CVSS4.8v3.1 | EPSS0.44% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-5318HIGH | Use of Hard-coded Credentials in microweber/microweberUse of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0. CWE-798Sep 30, 2023 | CVSS7.5v3.1 | EPSS0.541% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-5244MEDIUM | Cross-site Scripting (XSS) - Reflected in microweber/microweberCross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0. | CVSS6.1v3.1 | EPSS1.06% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2023-3142MEDIUM | Cross-site Scripting (XSS) - Stored in microweber/microweberCross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0. CWE-79Jun 7, 2023 | CVSS5.4v3.1 | EPSS0.346% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-2240HIGH | Improper Privilege Management in microweber/microweberImproper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4. CWE-269Apr 22, 2023 | CVSS8.8v3.1 | EPSS0.706% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-2239MEDIUM | Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweberExposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4. CWE-359Apr 22, 2023 | CVSS6.5v3.1 | EPSS0.504% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-2014MEDIUM | Cross-site Scripting (XSS) - Generic in microweber/microweberCross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3. CWE-79Apr 13, 2023 | CVSS4.8v3.1 | EPSS0.484% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-1881MEDIUM | Cross-site Scripting (XSS) - Stored in microweber/microweberCross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. CWE-79Apr 5, 2023 | CVSS5.4v3.1 | EPSS0.493% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-1877CRITICAL | Command Injection in microweber/microweberCommand Injection in GitHub repository microweber/microweber prior to 1.3.3. CWE-77Apr 5, 2023 | CVSS9.8v3.1 | EPSS1.8% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-1081MEDIUM | Cross-site Scripting (XSS) - Stored in microweber/microweberCross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. CWE-79Feb 28, 2023 | CVSS4.8v3.1 | EPSS0.434% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-0608MEDIUM | Cross-site Scripting (XSS) - DOM in microweber/microweberCross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2. CWE-79Feb 1, 2023 | CVSS5.4v3.1 | EPSS0.519% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-4732HIGH | Unrestricted Upload of File with Dangerous Type in microweber/microweberUnrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2. CWE-434Dec 24, 2022 | CVSS7.2v3.1 | EPSS38.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-4647MEDIUM | Cross-site Scripting (XSS) - Stored in microweber/microweberCross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2. CWE-79Dec 22, 2022 | CVSS6.1v3.1 | EPSS0.488% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-4617MEDIUM | Cross-site Scripting (XSS) - Reflected in microweber/microweberCross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2. CWE-79Dec 21, 2022 | CVSS6.1v3.1 | EPSS0.616% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-3245MEDIUM | Code Injection in display of tag title on saving tags in microweber/microweberHTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. | CVSS6.1v3.1 | EPSS0.587% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-3242MEDIUM | HTML code Injection in template search keyword in microweber/microweberCode Injection in GitHub repository microweber/microweber prior to 1.3.2. | CVSS6.1v3.1 | EPSS1.44% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2022-2777MEDIUM | Cross-site Scripting (XSS) - Stored in microweber/microweberCross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1. CWE-79Aug 11, 2022 | CVSS5.4v3.1 | EPSS0.438% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-2470MEDIUM | Cross-site Scripting (XSS) - Reflected in microweber/microweberCross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21. CWE-79Jul 22, 2022 | CVSS6.1v3.1 | EPSS0.931% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-2495MEDIUM | Cross-site Scripting (XSS) - Stored in microweber/microweberCross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21. CWE-79Jul 22, 2022 | CVSS4.8v3.1 | EPSS0.657% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-2368MEDIUM | Authentication Bypass by Spoofing in microweber/microweberAuthentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20. CWE-290Jul 11, 2022 | CVSS6.5v3.1 | EPSS1.08% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-2353MEDIUM | Cross-Site Request Forgery (CSRF) in microweber/microweberPrior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user. | CVSS6.1v3.1 | EPSS0.508% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |