Integer Overflow or Wraparound in Microweber

HIGH 7.5CVE-2022-1036 · GHSA-3qr6-qrqm-8v86 · Published 22/03/2022 · updated 17/06/2026

In short

CVE-2022-1036 is a HIGH (CVSS 7.5) vulnerability affecting microweber/microweber, microweber (microweber).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.8% of all vulnerabilities.
Fix: update to 1.2.12 or later.

Package	Affected versions	Patched versions
microweber/microweber Packagist	`< 1.2.12`	`1.2.12`
microweber microweber	`< 1.2.12`	`1.2.12`

Description

In Microweber prior to 1.2.12, a user can create an account with a password thousands of characters in length, leading to memory corruption/integer overflow. Version 1.2.2 sets maximum password length at 500 characters.

NVD description

Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.

References

nvd.nist.gov/vuln/detail/CVE-2022-1036 · ADVISORY
microweber/microweber commit 82be4f0 · WEB
microweber/microweber · PACKAGE
huntr.dev/bounties/db615581-d5a9-4ca5-a3e9-7a39eceaa424 · WEB

More vulnerabilities in microweber/microweber

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

microweber/microweber

Packagist

< 1.2.12

1.2.12

microweber

< 1.2.12

1.2.12

Description

NVD description

Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.

More vulnerabilities in microweber/microweber

See all →