CVE-2022-1439

Description

Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.

NVD

Severity: MEDIUM
CVE ID: CVE-2022-1439
CVSS Score: 6.1
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

huntr.dev

Severity: MEDIUM
CVE ID: CVE-2022-1439
CVSS Score: 6.3
CVSS Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Refrence: NVDMITRE

Proof Of Concept

Nuclei Templates for CVE-2022-1439

Refrence: Project Discovery GitHub