CVE-2022-1439: Microweber

Medium severity, CVSS 6.1. EPSS: 3.3% chance of exploitation in the next 30 days.

Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.

Affected products

• Microweber Microweber: before 1.2.15 (fixed in 1.2.15)

Published 2022-04-22. Last modified 2026-06-17.