Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas3007▼ 68 respecto a la semana anterior

Críticas / altas1421▲ 55 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)382▼ 128 respecto a la semana anterior

120 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2023-49052	Modificada	Alta (8.8)	2.4%	—	Microweber	30/11/2023	17/6/2026	File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component.
CVE-2023-47379	Modificada	Media (5.4)	0.51%	—	Microweber	8/11/2023	17/6/2026	Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.
CVE-2023-5976	Modificada	Media (4.3)	0.39%	—	Microweber	7/11/2023	17/6/2026	Improper Access Control in GitHub repository microweber/microweber prior to 2.0.
CVE-2023-5861	Modificada	Media (4.8)	0.44%	—	Microweber	31/10/2023	17/6/2026	Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
CVE-2023-5318	Modificada	Alta (7.5)	0.65%	—	Microweber	30/9/2023	17/6/2026	Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.
CVE-2023-5244	Modificada	Media (6.1)	1.1%	—	Microweber	28/9/2023	17/6/2026	Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
CVE-2023-3142	Modificada	Media (5.4)	0.35%	—	Microweber	7/6/2023	17/6/2026	Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
CVE-2023-2239	Modificada	Media (6.5)	0.50%	—	Microweber	22/4/2023	17/6/2026	Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
CVE-2023-2240	Modificada	Alta (8.8)	0.71%	—	Microweber	22/4/2023	17/6/2026	Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.
CVE-2023-2014	Modificada	Media (4.8)	0.48%	—	Microweber	13/4/2023	17/6/2026	Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.
CVE-2023-1881	Modificada	Media (5.4)	0.49%	—	Microweber	5/4/2023	17/6/2026	Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
CVE-2023-1877	Modificada	Crítica (9.8)	1.8%	—	Microweber	5/4/2023	17/6/2026	Command Injection in GitHub repository microweber/microweber prior to 1.3.3.
CVE-2023-1081	Modificada	Media (4.8)	0.43%	—	Microweber	28/2/2023	17/6/2026	Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
CVE-2021-32856	Modificada	Media (6.1)	0.63%	—	Microweber	21/2/2023	17/6/2026	Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and…
CVE-2023-0608	Modificada	Media (5.4)	0.52%	—	Microweber	1/2/2023	17/6/2026	Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2022-4732	Modificada	Alta (7.2)	38%	—	Microweber	27/12/2022	17/6/2026	Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2022-4647	Modificada	Media (6.1)	0.51%	—	Microweber	22/12/2022	17/6/2026	Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2022-4617	Modificada	Media (6.1)	0.63%	—	Microweber	21/12/2022	17/6/2026	Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2022-0698	Modificada	Media (6.1)	0.71%	—	Microweber	25/11/2022	17/6/2026	Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.
CVE-2022-33012	Modificada	Alta (8.8)	1.4%	—	Microweber	22/11/2022	17/6/2026	Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.
CVE-2022-3245	Modificada	Media (6.1)	0.72%	—	Microweber	20/9/2022	17/6/2026	HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
CVE-2022-3242	Modificada	Media (6.1)	1.9%	—	Microweber	20/9/2022	17/6/2026	Code Injection in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2022-2777	Modificada	Media (5.4)	0.46%	—	Microweber	11/8/2022	17/6/2026	Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.
CVE-2022-2470	Modificada	Media (6.1)	0.95%	—	Microweber	22/7/2022	17/6/2026	Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.
CVE-2022-2495	Modificada	Media (4.8)	0.67%	—	Microweber	22/7/2022	17/6/2026	Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.