CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 11/12/2025 |
| CVE-2025-60954 | 高8.3 | Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts. | 24/10/2025 |
| CVE-2025-51504 | 高7.6 | Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. | 01/08/2025 |
| CVE-2025-51502 | 中6.1 | Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users. | 01/08/2025 |
| CVE-2025-51501 | 中6.1 | Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript. | 01/08/2025 |
| CVE-2025-51503 | 高7.6 | A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers. | 31/07/2025 |
| CVE-2025-34076 | 高7.2 | An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file | 02/07/2025 |
| CVE-2025-2214 | 中6.1 | A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/website_group/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting. The attack may be ini | 12/03/2025 |
| CVE-2024-33299 | 中4.7 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users | 10/01/2025 |
| CVE-2024-33298 | 中6.1 | Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup | 10/01/2025 |
| CVE-2024-33297 | 中4.7 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function | 10/01/2025 |
| CVE-2024-40101 | 中6.1 | A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter. | 06/08/2024 |
| CVE-2024-41381 | 中6.1 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php. | 05/08/2024 |
| CVE-2024-41380 | 中6.1 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php. | 05/08/2024 |
| CVE-2023-6832 | 中4.3 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. | 15/12/2023 |
| CVE-2023-48122 | 高7.5 | An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method. | 08/12/2023 |
| CVE-2023-6599 | 中4.3 | Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0. | 08/12/2023 |
| CVE-2023-6566 | 中6.5 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. | 07/12/2023 |