GHSA-8c76-mxv5-w4g8

Stored Cross-site Scripting in Microweber

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-0954

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	microweber/microweber	< 1.2.12	1.2.12

Details

As written in the advisory (Markdown source, shown as plain text).

Microweber 1.2.11 and prior contains multiple stored cross-site scripting vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-0954 advisory
https://github.com/microweber/microweber/commit/955471c27e671c49e4b012e3b120b004082ac3f7 web
https://github.com/microweber/microweber package
https://huntr.dev/bounties/b99517c0-37fc-4efa-ab1a-3591da7f4d26 web