CVE-2020-23138

9.8 criticalEPSS 1.3%

Critical (9.8) in microweber microweber. EPSS 1.3% chance of exploitation in the next 30 days.

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension (eg- .exe) to the web server by providing image data and the image/jpeg content type with a .php extension.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2020-11-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

microweber:microweber

References

https://gist.github.com/virendratiwari03/0918aaba97eba31666630996ab3aeec3
https://gist.github.com/virendratiwari03/800f96271f22c0c2f5aea126c7f1f170
https://gist.github.com/virendratiwari03/0918aaba97eba31666630996ab3aeec3
https://gist.github.com/virendratiwari03/800f96271f22c0c2f5aea126c7f1f170

Check your stack JSON