CVE-2020-13405: Microweber

High severity, CVSS 7.5. EPSS: 13.6% chance of exploitation in the next 30 days.

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.

Affected products

• Microweber Microweber: before 1.1.20 (fixed in 1.1.20)

Published 2020-07-16. Last modified 2026-06-17.