CVE-2020-23138

—

CVSS 3.1

9.8 critical

EPSS

1%p69

Published

Nov 9, 2020 (Nov 9, 2020)

Modified

Jun 17, 2026

Description

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension (eg- .exe) to the web server by providing image data and the image/jpeg content type with a .php extension.

Vendors: microweber
Products: microweber
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.