microweber/microweber (Packagist)
Advisories
106
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.0.20 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require microweber/microweber:^2.0.20Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vv4x-qcpq-wgrg Microweber vulnerable to Path Traversal |
High EPSS 0.53% |
<= 2.0.20 | No fix yet |
| GHSA-6w5w-jx4x-vjvw Microweber Cross-site Scripting vulnerability |
Medium EPSS 0.32% |
< 2.0.20 | 2.0.20 |
| GHSA-5jg5-xqfw-rv92 Microweber has a Cross-site Scripting vulnerability |
Medium EPSS 0.31% |
< 2.0.20 | 2.0.20 |
| GHSA-2x2j-3c2v-g3c2 Microweber XSS Vulnerability in the homepage Endpoint |
High EPSS 0.55% |
>= 2.0.0, <= 2.0.19 | No fix yet |
| GHSA-mvj3-hc7j-vp74 Microweber has Reflected XSS Vulnerability in the layout Parameter |
Medium EPSS 0.86% |
>= 2.0.0, <= 2.0.19 | No fix yet |
| GHSA-8357-fjvx-xrm8 Microweber has Reflected XSS Vulnerability in the id Parameter |
Medium EPSS 0.86% |
>= 2.0.0, <= 2.0.19 | No fix yet |
| GHSA-782f-gxj5-xvqc Microweber Has Stored XSS Vulnerability in User Profile Fields |
High EPSS 0.54% |
>= 2.0.0, <= 2.0.19 | No fix yet |
| GHSA-j64v-xh5w-8hqj Microweber CMS API has authenticated local file inclusion vulnerability |
High EPSS 2.24% |
< 1.2.11 | 1.2.11 |
| GHSA-hcgh-r5gq-6qc2 Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler |
Medium EPSS 0.52% |
<= 2.0.19 | No fix yet |
| GHSA-97h9-p9f8-4p3r Microweber Cross-site Scripting vulnerability |
Medium EPSS 1.16% |
<= 2.0.9 | No fix yet |
| GHSA-w5g5-4jj3-8f6v Microweber Cross-site Scripting vulnerability |
Medium EPSS 0.88% |
<= 2.0.9 | No fix yet |
| GHSA-j4v9-cm37-h7c2 Microweber Cross-site Scripting vulnerability |
Medium EPSS 1.16% |
<= 2.0.9 | No fix yet |
| GHSA-m99v-mmg2-66vf Microweber Reflected Cross-site scripting (XSS) vulnerability |
Medium EPSS 0.90% |
< 2.0.16 | 2.0.16 |
| GHSA-h4xf-wx99-jmv4 Microweber Cross Site Scripting (XSS) vulnerability |
Medium EPSS 0.31% |
<= 2.0.16 | No fix yet |
| GHSA-hf66-xfgj-42g8 Microweber Cross Site Scripting (XSS) vulnerability |
Medium EPSS 0.31% |
<= 2.0.16 | No fix yet |
| GHSA-qjfx-fvx7-3wvw Business Logic Errors in microweber/microweber |
Medium EPSS 0.51% |
< 2.0.0 | 2.0.0 |
| GHSA-p8q6-qrgj-7gx2 Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method |
High EPSS 0.85% |
>= 2.0.1, < 2.0.4 | 2.0.4 |
| GHSA-9r6p-hg4g-5gxp Microweber missing standardized error handling mechanism |
Medium EPSS 0.49% |
< 2.0.0 | 2.0.0 |
| GHSA-3rpx-pgmf-j96h Microweber Business Logic Errors |
Medium EPSS 0.49% |
< 2.0.0 | 2.0.0 |
| GHSA-2c7x-w3mx-h7p6 Microweber file upload vulnerability |
High EPSS 2.46% |
<= 2.0.4 | No fix yet |
| GHSA-jmwm-w2rm-prv9 Microweber Cross-site Scripting vulnerability |
Medium EPSS 0.51% |
< 2.0.3 | 2.0.3 |
| GHSA-q57g-38pc-jwv8 Microweber Improper Access Control vulnerability |
Medium EPSS 0.39% |
< 2.0.0 | 2.0.0 |
| GHSA-7q5f-29gx-57ff Cross-site Scripting (XSS) in microweber/microweber |
Medium EPSS 0.44% |
< 2.0.0 | 2.0.0 |
| GHSA-r657-3wqh-g2x9 Microweber uses hard coded credentials |
High EPSS 0.65% |
<= 1.3.4 | No fix yet |
| GHSA-rgf9-j7gv-rq22 Microweber Cross-site Scripting vulnerability |
Medium EPSS 1.12% |
<= 1.3.4 | No fix yet |
| GHSA-fqcv-rfp6-wv92 Microweber Cross-site Scripting vulnerability |
Medium EPSS 0.35% |
<= 1.3.4 | No fix yet |
| GHSA-h83h-77x2-6w6g Information exposure in microweber |
Medium EPSS 0.50% |
< 1.3.4 | 1.3.4 |
| GHSA-r6xq-xcxc-fghx Improper Privilege Management in microweber |
High EPSS 0.71% |
< 1.3.4 | 1.3.4 |
| GHSA-f4g6-c47x-qhww Microweber vulnerable to cross-site scripting (XSS) |
Medium EPSS 0.48% |
< 1.3.3 | 1.3.3 |
| GHSA-hhjm-mpmf-cxg9 Microweber vulnerable to stored cross-site scripting (XSS) via X-Forwarded-For header |
Medium EPSS 0.49% |
< 1.3.3 | 1.3.3 |
| GHSA-582p-2fpg-x226 Microweber vulnerable to command injection |
Critical EPSS 1.80% |
< 1.3.3 | 1.3.3 |
| GHSA-c2rc-8m9f-g4fh Microweber Cross-site Scripting vulnerability |
Medium EPSS 0.43% |
<= 1.3.2 | No fix yet |
| GHSA-mv37-xrmc-hf64 Microweber Cross-site Scripting vulnerability |
Medium EPSS 0.62% |
<= 1.2.12 | No fix yet |
| GHSA-pj97-r83v-vj7f Microweber contains Cross-site Scripting |
Medium EPSS 0.52% |
< 1.3.2 | 1.3.2 |
| GHSA-8h43-xg5g-9cj7 Microweber vulnerable to unrestricted malicious uploads |
High EPSS 38.24% |
< 1.3.2 | 1.3.2 |
| GHSA-9cmm-52cv-6hvc Microweber vulnerable to Stored Cross-Site Scripting |
Medium EPSS 0.56% |
<= 1.3.1 | No fix yet |
| GHSA-3mmh-vq9w-4c3g Microweber vulnerable to Reflected Cross-site Scripting |
Medium EPSS 0.66% |
<= 1.3.1 | No fix yet |
| GHSA-79gx-3fm8-qxqq Microweber vulnerable to cross-site scripting (XSS) |
Medium EPSS 0.74% |
<= 1.3.1 | No fix yet |
| GHSA-rp7f-fhm8-9hpf Account Takeover Through Password Reset Poisoning |
High EPSS 1.44% |
<= 1.2.15 | No fix yet |
| GHSA-232p-59mg-f98p Microweber Cross-site Scripting can result in redirection to a malicious site |
Medium EPSS 1.95% |
< 1.3.2 | 1.3.2 |
| GHSA-gm8c-w9cm-c445 Microweber vulnerable to HTML Injection in create tag functionality |
Medium EPSS 0.74% |
< 1.3.2 | 1.3.2 |
| GHSA-cf6r-q678-f2p7 Microweber's title parameter in the body of POST request vulnerable to stored XSS |
Medium EPSS 0.47% |
< 1.3.1 | 1.3.1 |
| GHSA-xg72-6c83-ghh4 Microweber Stored Cross-site Scripting before v1.2.20 |
Medium EPSS 0.69% |
< 1.2.20 | 1.2.20 |
| GHSA-cfcg-2qgr-v243 Microweber before 1.2.21 vulnerable to reflected XSS |
Medium EPSS 0.97% |
< 1.2.21 | 1.2.21 |
| GHSA-9wqr-9787-p4rf Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password |
Medium EPSS 1.16% |
< 1.2.21 | 1.2.21 |
| GHSA-gmh3-x5w7-jg5m Microweber before v1.2.20 vulnerable to cross-site scripting |
Medium EPSS 0.53% |
< 1.2.20 | 1.2.20 |
| GHSA-q6mp-562x-ggvv Cross-site Scripting in microweber |
Medium EPSS 0.54% |
< 1.2.19 | 1.2.19 |
| GHSA-5pg2-qg87-vmj7 Cross-site Scripting in microweber |
Medium EPSS 0.60% |
< 1.2.19 | 1.2.19 |
| GHSA-437j-5qc3-c589 Open Redirect in microweber |
Medium EPSS 0.93% |
< 1.2.19 | 1.2.19 |
| GHSA-3x96-m42v-hvh5 Cross-site Scripting in Microweber |
Medium EPSS 2.64% |
< 1.2.18 | 1.2.18 |
| GHSA-27g3-58v4-fg9w Cross-site Scripting in Microweber |
Medium EPSS 3.15% |
<= 1.2.17 | No fix yet |
| GHSA-g7r3-jwhw-2wfv Microweber Insufficient Session Expiry |
Medium EPSS 0.32% |
No fix yet | |
| GHSA-pmxg-w9c7-ffmq Microweber Discloses Sensitive Information |
High EPSS 13.61% |
< 1.1.20 | 1.1.20 |
| GHSA-89fp-j8v7-p82h Microweber allows Unrestricted File Upload |
High EPSS 0.46% |
<= 1.1.18 | No fix yet |
| GHSA-xmcr-x5x3-gjfx Microweber XSS Vulnerability |
Medium EPSS 1.32% |
< 1.1 | 1.1 |
| GHSA-582j-m369-hj2f Microweber XSS Vulnerability |
Medium EPSS 1.58% |
<= 1.0.8 | No fix yet |
| GHSA-73rp-q4rx-5grc Incorrect Authorization in microweber |
High EPSS 8.85% |
< 1.2.15 | 1.2.15 |
| GHSA-6346-5r4h-ff5x Microweber vulnerable to cross-site scripting (XSS) |
Medium EPSS 1.25% |
<= 1.2.15 | No fix yet |
| GHSA-f23x-4gf4-m9ff Cross-site Scripting in Microweber |
Medium EPSS 0.85% |
< 1.2.16 | 1.2.16 |
| GHSA-6xj3-fhrf-rjgc Cross-site Scripting in microweber |
Medium EPSS 0.99% |
< 1.2.15 | 1.2.15 |
| GHSA-9w7h-3wwh-6m5q Cross-site Scripting in Microweber |
Medium EPSS 3.26% |
< 1.2.15 | 1.2.15 |
| GHSA-3qr6-qrqm-8v86 Integer Overflow or Wraparound in Microweber |
High EPSS 1.23% |
< 1.2.12 | 1.2.12 |
| GHSA-hrf4-hcpc-3345 Denial of service in microweber |
High EPSS 1.01% |
<= 1.2.11 | No fix yet |
| GHSA-8c76-mxv5-w4g8 Stored Cross-site Scripting in Microweber |
Medium EPSS 3.20% |
< 1.2.12 | 1.2.12 |
| GHSA-q3x2-jvp3-wj78 Unrestricted XML files leading to cross-site scripting in Microweber |
Medium EPSS 1.88% |
< 1.2.12 | 1.2.12 |
| GHSA-5fxv-xx5p-g2fv Integer Overflow in microweber |
High EPSS 3.73% |
<= 1.2.11 | No fix yet |
| GHSA-3q55-66g3-p8xq Cross-site Scripting in microweber |
Medium EPSS 0.78% |
< 1.2.12 | 1.2.12 |
| GHSA-5fxf-x22x-5q38 Cross-site Scripting in microweber |
Medium EPSS 1.08% |
< 1.2.12 | 1.2.12 |
| GHSA-2cv6-6437-39p2 Cross-site Scripting in microweber |
Medium EPSS 0.91% |
< 1.2.12 | 1.2.12 |
| GHSA-c383-q5vf-hx55 Integer Overflow or Wraparound in Microweber |
High EPSS 1.42% |
< 1.2.12 | 1.2.12 |
| GHSA-6vx5-cg2p-7g5v Unrestricted Upload of File with Dangerous Type in microweber |
Medium EPSS 0.54% |
< 1.2.12 | 1.2.12 |
| GHSA-jjp3-m93h-5jm4 Cross-site Scripting in microweber |
Medium EPSS 2.39% |
< 1.2.12 | 1.2.12 |
| GHSA-j878-43hm-8gr5 Unrestricted Upload of File with Dangerous Type in Microweber |
Medium EPSS 2.21% |
< 1.2.12 | 1.2.12 |
| GHSA-hf4q-52x6-4p57 Unrestricted file upload leads to stored cross-site scripting in Microweber |
Medium EPSS 0.62% |
< 1.2.12 | 1.2.12 |
| GHSA-x28w-hvwc-mp75 Static Code Injection in Microweber |
High EPSS 1.75% |
< 1.3 | 1.3 |
| GHSA-q9qc-pp5x-mc8c Improper Neutralization of Special Elements Used in a Template Engine in microweber |
High EPSS 1.41% |
< 1.3 | 1.3 |
| GHSA-7r79-mrp6-8mhq Rate limit missing in microweber |
High EPSS 1.24% |
< 1.3 | 1.3 |
| GHSA-5875-p652-2ppm Exposure of Resource to Wrong Sphere in microweber |
Medium EPSS 0.65% |
< 1.3.0 | 1.3.0 |
| GHSA-4p92-fv6v-fhfj Cross-site Scripting in microweber |
Medium EPSS 0.90% |
< 1.2.11 | 1.2.11 |
| GHSA-6m26-25q2-cq46 Cross-site Scripting in microweber |
Medium EPSS 0.62% |
< 1.3 | 1.3 |
| GHSA-mjvc-j6rv-9xj8 Insertion of Sensitive Information Into Debugging Code in Microweber |
High EPSS 1.40% |
< 1.3 | 1.3 |
| GHSA-j8cx-j9j2-f29w Insecure Storage of Sensitive Information in Microweber |
High EPSS 1.35% |
< 1.3 | 1.3 |
| GHSA-hj8g-cw8x-2c6m Cross-site Scripting in Microweber |
High EPSS 0.91% |
< 1.3 | 1.3 |
| GHSA-c5gj-w4hx-gvmx Business Logic Errors in microweber |
Low EPSS 0.92% |
< 1.2.11 | 1.2.11 |
| GHSA-38m9-3vg4-rwvp Cross-site Scripting in microweber |
Medium EPSS 2.27% |
< 1.2.11 | 1.2.11 |
| GHSA-3p9j-442x-hjp7 Business Logic Errors in microweber |
Medium EPSS 1.05% |
< 1.2.11 | 1.2.11 |
| GHSA-rgp5-m2pq-3fmg Cross-site Scripting in microweber |
High EPSS 1.10% |
< 1.2.11 | 1.2.11 |
| GHSA-hhrj-wp42-32v3 Generation of Error Message Containing Sensitive Information in microweber |
High EPSS 6.92% |
< 1.2.11 | 1.2.11 |
| GHSA-3wwj-wh2w-g4xp CRLF Injection in microweber |
High EPSS 44.26% |
< 1.2.11 | 1.2.11 |
| GHSA-ghww-cv4v-hmxx Cross-Site Request Forgery microweber |
Medium EPSS 0.36% |
< 1.2.11 | 1.2.11 |
| GHSA-rw98-5846-pqhx Open redirect in microweber |
Medium EPSS 2.60% |
< 1.2.11 | 1.2.11 |
| GHSA-vpq7-m4qm-p2gp Microweber vulnerable to Improper Validation of Specified Quantity in Input |
Medium EPSS 0.62% |
< 1.2.11 | 1.2.11 |
| GHSA-vm37-j55j-8655 OS Command Injection in Microweber |
High EPSS 51.19% |
< 1.2.11 | 1.2.11 |
| GHSA-r992-xph6-h7x2 Open redirect in microweber |
Medium EPSS 1.04% |
< 1.2.11 | 1.2.11 |
| GHSA-wmj9-xh24-j4gx Cross-site Scripting in microweber |
Medium EPSS 0.90% |
< 1.2.11 | 1.2.11 |
| GHSA-pqcf-v8v5-jmcg Zip slip in Microweber |
High EPSS 16.61% |
< 1.2.3 | 1.2.3 |
| GHSA-xxq4-3742-3h28 Generation of Error Message Containing Sensitive Information in microweber |
Medium EPSS 1.15% |
<= 1.2.10 | No fix yet |
| GHSA-7x2h-3v2v-24p9 Cross-Site Request Forgery in microweber |
Medium EPSS 0.68% |
<= 1.2.10 | No fix yet |
| GHSA-jjvm-3mfq-7gc7 Cross-site Scripting in microweber |
Medium EPSS 0.63% |
<= 1.2.10 | No fix yet |
| GHSA-prff-6j8q-vrv7 Cross-site Scripting in microweber |
Medium EPSS 0.86% |
< 1.2.11 | 1.2.11 |
| GHSA-3j58-p785-f27x Cross-site Scripting in microweber |
Medium EPSS 3.87% |
< 1.2.11 | 1.2.11 |
| GHSA-m8rp-q82r-c5mf Cross-site Scripting in microweber |
Medium EPSS 0.73% |
< 1.2.11 | 1.2.11 |
| GHSA-7wv8-g97r-432h Exposure of Sensitive Information to an Unauthorized Actor in microweber |
High EPSS 10.48% |
< 1.2.11 | 1.2.11 |
| GHSA-vcgf-vmpc-ph79 Microweber Incorrect Permission Assignment for Critical Resource vulnerability |
Medium EPSS 1.12% |
< 1.2.11 | 1.2.11 |
| GHSA-p5hj-xxfr-pwc3 Code Injection in microweber |
High EPSS 1.38% |
< 1.2.11 | 1.2.11 |
| GHSA-w7x8-cq7r-g5g9 Cross Site Scripting in Microweber |
Medium EPSS 1.06% |
< 1.2.8 | 1.2.8 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor