CVE-2020-23140: Microweber

High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days.

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active.

Affected products

• Microweber Microweber: version 1.1.18 only

Published 2020-11-09. Last modified 2026-06-17.