Microweber vulnerabilities

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the 'group' parameter of the '/admin/settings' endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser.

In Microweber up to 2.0.20, a path traversal vulnerability exists in the userfiles_path function of /api_nosession/thumbnail_img via manipulation of the cache_path_relative argument. The attack can be launched remotely and the exploit is publicly available.

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Script payloads in the first name field execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.

A reflected XSS vulnerability exists in Microweber 2.0.15 and earlier in the '/search' endpoint. An unauthenticated remote attacker can inject arbitrary web script or HTML via the 'keywords' parameter.

A vulnerability in Microweber v1.1.18 causes the user session not to expire after logout. This allows an attacker to reuse a valid session for unauthorized access.