CVE-2014-9464
HighSummary
In Microweber CMS version 0.95 before 20141209, there is an SQL injection vulnerability in Category.php that allows remote attackers to execute arbitrary SQL commands via the category parameter.
Risk Assessment
This vulnerability may lead to unauthorized access to the database and exposure of sensitive information, posing a serious threat to the organization's security.
Recommendation
It is recommended to update Microweber CMS to the latest version to eliminate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in Microweber CMS 0.95
See all- CVE-2026-67617Medium
Microweber CMS up to version 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system. An authenticated attacker can inject arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls. The injected script executes without user interaction for every visitor to the public blog page and within the admin post editor.
- CVE-2026-65693High
Microweber CMS through version 2.0.20 contains a server-side template injection vulnerability. Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates.
- CVE-2026-65694High
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller. Unauthenticated attackers can read arbitrary files by supplying directory traversal sequences in the path query parameter.
Original NVD description (English source)
SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute arbitrary SQL commands via the category parameter when displaying a category, related to the $parent_id variable.