GHSA-9cmm-52cv-6hvc

Microweber vulnerable to Stored Cross-Site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-4647

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	microweber/microweber	<= 1.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Microweber versions 1.3.1 and prior are vulnerable to stored Cross-site Scripting (XSS). A patch is available on the 1.4, dev, and laravel-sail branches.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-4647 advisory
https://github.com/microweber/microweber/commit/20df56615e61624f5fff149849753869e4b3b936 web
https://github.com/microweber/microweber package
https://huntr.dev/bounties/ccdd243d-726c-4199-b742-25c571491242 web