| CVE-2026-12198 | ÉLEVÉE7.3 | A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit h | 15/06/2026 |
| CVE-2025-70792 | MOYENNE6.1 | Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the develope | 05/02/2026 |
| CVE-2025-70791 | MOYENNE6.1 | Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the | 05/02/2026 |
| CVE-2025-51504 | ÉLEVÉE7.6 | Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. | 01/08/2025 |
| CVE-2025-51502 | MOYENNE6.1 | Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users. | 01/08/2025 |
| CVE-2025-51501 | MOYENNE6.1 | Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript. | 01/08/2025 |
| CVE-2025-51503 | ÉLEVÉE7.6 | A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers. | 31/07/2025 |
| CVE-2025-34076 | ÉLEVÉE7.2 | An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file | 02/07/2025 |
| CVE-2025-2214 | MOYENNE6.1 | A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/website_group/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting. The attack may be ini | 12/03/2025 |
| CVE-2024-33299 | MOYENNE4.7 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users | 10/01/2025 |
| CVE-2024-33298 | MOYENNE6.1 | Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup | 10/01/2025 |
| CVE-2024-33297 | MOYENNE4.7 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function | 10/01/2025 |
| CVE-2024-40101 | MOYENNE6.1 | A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter. | 06/08/2024 |
| CVE-2024-41381 | MOYENNE6.1 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php. | 05/08/2024 |
| CVE-2024-41380 | MOYENNE6.1 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php. | 05/08/2024 |
| CVE-2023-6832 | MOYENNE4.3 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. | 15/12/2023 |
| CVE-2023-48122 | ÉLEVÉE7.5 | An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method. | 08/12/2023 |
| CVE-2023-6599 | MOYENNE4.3 | Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0. | 08/12/2023 |
| CVE-2023-6566 | MOYENNE6.5 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. | 07/12/2023 |
| CVE-2023-49052 | ÉLEVÉE8.8 | File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component. | 30/11/2023 |