Microweber vulnerabilities
We track 11 vulnerabilities in Microweber products across 4 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
Latest Microweber vulnerabilities
- 8.4 High severity
Administration panel: Unrestricted Upload of File with Dangerous Type
Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by
- 7.2 High severity
microweber: Improper Control of Generation of Code
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Tw
- 7.5 High severity
microweber: Improper Limitation of a Pathname to a Restricted Directory
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send
- 7.3 High severity
Microweber: Improper Limitation of a Pathname to a Restricted Directory
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal.
- 8.3 High severity
Microweber: Weak Password Requirements
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise
- 7.6 High severity
Microweber: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.
- 7.2 High severity
CMS: Improper Limitation of a Pathname to a Restricted Directory
An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files fro
- 8.8 High severity
Microweber: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component.
- 8.8 High severity
microweber/microweber: Incorrect Authorization
Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Em
- 7.5 High severity
microweber/microweber: Integer Overflow or Wraparound
Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.
- 7.5 High severity
microweber/microweber: Improper Neutralization of CRLF Sequences
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.