repository icon
microweber / microweber Project repository

Drag and Drop Website Builder and CMS with E-commerce

Submit a report

FIRST INTERACTION

WITHIN4 DAYS

REVIEW

WITHIN11 DAYS

FIX

WITHIN26 DAYS

Bypass rate limit defense in login feature
lengochoa7112000
pending
Stored HTML injection
x3419
pending
Persistent Active Session Token in Local Storage After Logout
sl4x0
pending
Stored XSS Vulnerability in Tag Name
cupc4k3
informative
Medium
Reflected XSS in /editor_tools/rte_image_editor
j0lger
Medium
•CVE-2023-5244
Secret information exfiltration by hard coding twitter API keys
scgajge12
Medium
•CVE-2023-5318
Exploiting a Disabled Coupon Functionality Vulnerability
lujiefsi
Medium
•CVE-2023-6832
Leaking error content at upload file
uonghoangminhchau
Low
•CVE-2023-6599
user can still comment the unpublish blog
lujiefsi
Medium
•CVE-2023-5976
Unpublish and Deleted product can be checkout
lujiefsi
Medium
•CVE-2023-6566
Cross site scripting on product Adding
ghostbit11
informative
Medium
Stored XSS in the module named "Dashboard"
chucsse
Medium
•CVE-2023-5861
Stored XSS on Multiple Edit Page
tht1997
Low
•CVE-2023-3142
Unauthenticated Access to Users PII
garthhumphreys
High
•CVE-2023-2239
Broken Access Control on "http://localhost/api/user" endpoint
cyberneticsplus
High
•CVE-2023-2240
Insufficient Session Expiration for Deleted Admin User Account
cyberneticsplus
duplicate
Medium
Stored XSS on Settings/Privacy_Policy
cyberneticsplus
informative
High
HTML Injection on Settings/Template
cyberneticsplus
Medium
•CVE-2023-2014
1
isdkrisna
self closed
tes aaaaaaa
adelittle
self closed
Stored XSS From Visitor to Acc Takeover
isdkrisna
High
•CVE-2023-1881
Unauthenticated Arbitrary File Read
cupc4k3
not applicable
RCE by Server Side Template Injection
cupc4k3
Medium
•CVE-2023-1877
Restrictive composer.json makes Dompdf vulnerable to URI validation failure on S...
martian1337
Low
•CVE-2023-1876
Stored XSS in the module named "Website settings"
christynorl
Medium
•CVE-2023-1081
File Upload Filter Bypass
cr4ckc4t
Medium
•CVE-2022-4732
Internal path disclosure
nilabhrajpoot
informative
High
xss in live edit
a7med-m7moued
Medium
•CVE-2022-4647
Post parameter namespaceMD5 is vulnerable to reflected XSS
krizzsk
Low
•CVE-2022-4617
Reflected XSS
0xgad
informative
Medium
Cross-site Scripting (XSS) - Reflected in
ahmed8magdy
informative
High
Stored Cross-Site Scripting in add/edit post content
ar6aaz
informative
High
Xss vulnerability in Button module
christynorl
Medium
•CVE-2023-0608
Password Reset Poisoning
vautia
informative
Low
html injection on https://demo.microweber.org/demo/search.php?keywords=
anupamas0x1
Medium
•CVE-2022-3242
HTML Injection vulnerability in create tag functionality
nithissh200
Medium
•CVE-2022-3245
Weak Password Change Mechanism
7h3h4ckv157
informative
Medium
Weak Password Requirements
7h3h4ckv157
informative
Medium
Cross-site Scripting (XSS) - Stored
a1ise
informative
Medium
Stored Cross-Site Scripting (XSS) vulnerability on category name of edit_categor...
scriptidiot
informative
Medium
Cross-site Scripting (XSS) - Stored on Translations
ahkecha
Low
Stored XSS on Categories
ahkecha
Medium
•CVE-2022-2777
Cross-site Scripting (XSS) - Reflected
kingerbans
Low
•CVE-2022-2470
Bypass IP detection to brute-force password
nhienit2010
Medium
•CVE-2022-2368
Cross-site scripting - DOM
nhienit2010
Medium
•CVE-2022-2353
Stored XSS via SVG File
thwinhtetwin
Medium
•CVE-2022-2495
Improper handling of parameter lead to listing any directory
nhienit2010
Medium
Cross-site scripting - Stored via upload ".xlr" file
nhienit2010
Low
Cross-site scripting - Stored via upload ".pages" file
nhienit2010
Medium
•CVE-2022-2300
Bypassing SVG content cleaning lead to Stored XSS
flex0geek
Medium
•CVE-2022-2280
Bypass open redirect protection
flex0geek
Medium
•CVE-2022-2252
CSRF attack while uploading files on [/plupload] via GET request
flex0geek
Low
Unverified Password Change When a User Changes Password
dievus
informative
High
Reflected XSS on /api/module
jhond0e
Medium
•CVE-2022-2174
Reflected XSS on /editor_tools/module
jhond0e
Medium
•CVE-2022-2130
Path Traversal via Files Manager
domiee13
Low
UI REDRESSING
tharunavula
Medium
Application Level DoS:
7h3h4ckv157
Low
Blind SSRF with out-of-band
jesusmariabermudez
informative
High
The microweber application allows large characters to insert in the input field...
akshayravic09yc47
None
Stack Trace error leads to source code/backend sensitive information disclosure
akshayravic09yc47
not applicable
0 quantity orders are allowed
m1m1cat
Low
Users Account Pre-Takeover or Users Account Takeover.
thewhiteevil
Medium
•CVE-2022-1631
DOM XSS in microweber ver 1.2.15
minhnb11
High
•$15•CVE-2022-1555
Reflected XSS
wfinn
Medium
•CVE-2022-1584
Cross-site scripting - DOM via view file function
nhienit2010
Low
Reflected XSS in microweber
minhnb11
Low
Cross-site scripting - Stored via upload ".msg" file
nhienit2010
Low
Cross-site scripting - Stored via upload ".cad" file
nhienit2010
Low
Cross-site Request Forgery (CSRF) in login page
nhienit2010
informative
High
Reflect XSS on demo.microweber.org
minhnb11
not applicable
XSS in /demo/module/?module=HERE
wfinn
Medium
•CVE-2022-1504
Reflected XSS on demo.microweber.org/demo/module/
wfinn
Medium
•CVE-2022-1439
CSRF on update cart functionality
nithissh200
Low
The microweber application allows large characters to insert in the input field...
sampritdas8
None
stored xss in uploaded photo checkbox
keralaboy123
Low
Able to create an account with long password leads to memory corruption / Intege...
nithissh200
Medium
•CVE-2022-1036
Path Traversal
thanhlocstudent
Low
The microweber application allows large characters to insert in the input field...
vishalvishw10
None
The microweber application allows large characters to insert in the input field...
akshayravic09yc47
None
No Rate Limit on Copoun Code Functionality
itsfading
Low
The microweber application allows large characters to insert in the input field...
akshayravic09yc47
High
•CVE-2022-0968
The microweber application allows large characters to insert in the input field...
akshayravic09yc47
High
•$1.5•CVE-2022-0961
Unrestricted XML Files Leads to Stored XSS
thanhlocstudent
Medium
•CVE-2022-0963
Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Setti...
scriptidiot
Medium
•CVE-2022-0954
File upload filter bypass leading to stored XSS
scriptidiot
High
•CVE-2022-0930
XSS on dynamic_text module
rajeshpatil013
Medium
•CVE-2022-0929
Unrestricted Upload of File with Dangerous Type
nhiephon
Medium
•CVE-2022-0912
Integer Overflow or Wraparound
sampritdas8
Critical
•$25•CVE-2022-0913
File upload filter bypass leading to stored XSS
rajeshpatil013
High
•$15•CVE-2022-0926
Abusing Backup/Restore feature to achieve Remote Code Execution
quandqn
High
•$15•CVE-2022-0921
Cross-site Scripting (XSS) - Stored
scriptidiot
Medium
•CVE-2022-0928
Unrestricted file upload leads to stored XSS
quandqn
Medium
•CVE-2022-0906
Static Code Injection
crowdoverflow
High
•$1•CVE-2022-0895
Improper Neutralization of Special Elements Used in a Template Engine
crowdoverflow
High
•$15•CVE-2022-0896
Insufficient Granularity of Access Control
rajeshpatil013
Medium
Weak Password Recovery Mechanism for Forgotten Password
hdvinnie
High
•$15•CVE-2022-0777
Business Logic Errors
tuonggg
Medium
•CVE-2022-0762
Cross-site Scripting (XSS) - Stored
tuonggg
Medium
•CVE-2022-0763
Cross-site Scripting (XSS) - Reflected
daman-preet-singh
High
•CVE-2022-0719
Insertion of Sensitive Information Into Debugging Code
daman-preet-singh
High
•$17•CVE-2022-0721
Cross-site Scripting (XSS) - Reflected
daman-preet-singh
High
•$15•CVE-2022-0723
Insecure Storage of Sensitive Information
sampritdas8
Critical
•$25•CVE-2022-0724
Cross-site Scripting (XSS) - Reflected
daman-preet-singh
High
•$15•CVE-2022-0690
Uncaught Exception
daman-preet-singh
High
Use multiple time the one-time coupon
am0o0
Medium
•$25•CVE-2022-0689
Business Logic Errors
nithissh200
Critical
•$25•CVE-2022-0688
Cross-site Scripting (XSS) - Reflected
p0cas
Medium
•$15•CVE-2022-0678
Improper Input Validation
nithissh200
High
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https:...
yashrk078
High
•CVE-2022-0666
Improper Handling of Length Parameter Inconsistency
nithissh200
High
Generation of Error Message Containing Sensitive Information
0x2374
Critical
•CVE-2022-0660
Open Redirect
kushagrasarathe
Medium
•CVE-2022-0597
Business Logic Errors
dev696
Medium
•CVE-2022-0596
Cross-site Scripting (XSS) - Stored
nithissh200
Critical
•CVE-2022-0558
OS Command Injection
aggressiveuser
High
•CVE-2022-0557
External Control of File Name or Path
talhakarakumru
High
Cross-site Scripting (XSS) - Stored
inweol
High
•CVE-2022-0506
Cross-site Scripting (XSS) - Stored
nithissh200
High
•$8.5•CVE-2022-0379
Cross-Site Request Forgery (CSRF)
shubh123-tri
Medium
•$20•CVE-2022-0505
Generation of Error Message Containing Sensitive Information
shubh123-tri
Medium
•$35•CVE-2022-0504
Exposure of Sensitive Information to an Unauthorized Actor
r0hansh
High
•$45•CVE-2022-0281
Improper Access Control
r0hansh
Medium
•$45•CVE-2022-0277
Cross-site Scripting (XSS) - Stored
r0hansh
High
•$22.5•CVE-2022-0278
Code Injection
r0hansh
Medium
•$4.5•CVE-2022-0282
Cross-site Scripting (XSS) - Reflected
r0hansh
High
•$22.5•CVE-2022-0378
Open Redirect
r0hansh
Medium
•$4.5•CVE-2022-0560
Cross-Site Request Forgery (CSRF)
hdvinnie
Medium
•$22.5•CVE-2022-0638
Cross-Site Request Forgery (CSRF)
am0o0
Low
•$26
Business Logic Errors
haxatron
High
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$44
Improper Restriction of Power Consumption
am0o0
Medium
•$40
Improper Validation of Integrity Check Value
am0o0
Medium
•$40
Session Fixation
am0o0
Low
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$31.25
Improper Privilege Management
thelabda
Medium
•$12.5
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
High
•$20
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$11.25
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$25
Cross-Site Request Forgery (CSRF)
am0o0
High
•$25
Cross-Site Request Forgery (CSRF)
am0o0
High
•$25
Cross-Site Request Forgery (CSRF)
am0o0
High
•$25
Cross-Site Request Forgery (CSRF)
effectrenan
High
•$25
Business Logic Errors
effectrenan
High
•$25
Cross-site Scripting (XSS) - Stored
20kilograma
Medium
•$25
Unrestricted Upload of File with Dangerous Type
ready-research
High
•$25•CVE-2020-23138