In breve
- CVE-2022-1439 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda microweber/microweber, microweber (microweber).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.3%, superiore al 88.4% delle vulnerabilità.
- Correzione: aggiornare a 1.2.15 o successiva.
Description
Microweber prior to 1.2.15 is vulnerable to reflected cross-site scripting on demo.microweber.org/demo/module/. This allows the execution of arbitrary JavaScript as the attacked user.
NVD description
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free