Microweber CVE-2022-0895

CRITICAL

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') (CWE-96)

2022-03-10 security@huntr.dev

Code Injection Microweber

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Mar 10, 2022 - 11:15 nvd

CRITICAL 9.8

DescriptionNVD

Static Code Injection in GitHub repository microweber/microweber prior to 1.3.

AnalysisAI

Static Code Injection in GitHub repository microweber/microweber prior to 1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-96. Static Code Injection in GitHub repository microweber/microweber prior to 1.3. Affected products include: Microweber. Version information: prior to 1.3..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Microweber

View all

CVE-2025-34076 HIGH Act Now POC

An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the ba

CVE-2023-1877 CRITICAL Act Now POC

Command Injection in GitHub repository microweber/microweber prior to 1.3.3. Rated critical severity (CVSS 9.8), this vu

CVE-2022-2368 CRITICAL Act Now POC

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20. Rated critical severity (C

CVE-2023-49052 HIGH This Week POC

File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script

CVE-2022-33012 HIGH This Week POC

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.

CVE-2022-1631 HIGH This Week POC

Users Account Pre-Takeover or Users Account Takeover. Rated high severity (CVSS 8.8), this vulnerability is remotely exp

CVE-2022-0896 HIGH This Week POC

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior t

CVE-2018-17104 HIGH This Week POC

An issue was discovered in Microweber 1.0.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,

CVE-2014-9464 HIGH This Week POC

SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute ar

CVE-2020-13241 HIGH This Week POC

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not veri

CVE-2023-48122 HIGH This Week POC

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTT

CVE-2022-1036 HIGH This Week POC

Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweb

Same weakness CWE-96 – Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

View all

CVE-2015-2079 CRITICAL POC

CVE-2020-6144 CRITICAL POC

CVE-2020-6143 CRITICAL POC

CVE-2024-55877 HIGH POC

CVE-2024-55662 HIGH POC

CVE-2023-39726 CRITICAL

CVE-2025-30091 CRITICAL

CVE-2025-57707 HIGH

Same technique Code Injection

View all

CVE-2012-0158 HIGH POC

CVE-2014-6287 CRITICAL POC

CVE-2017-7494 CRITICAL POC

CVE-2025-24893 CRITICAL POC

CVE-2025-47812 CRITICAL POC

CVE-2013-3906 HIGH POC

CVE-2017-9822 HIGH POC

CVE-2018-1273 CRITICAL POC

Share

CVE-2022-0895 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy