CVE-2022-3245

Code Injection in display of tag title on saving tags in microweber/microweber

4.3 MediumFix available

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.74%Down 0.1 points since Sep 21, 2022

What each source reports

CVE List Score used 4.3

Code Injection in display of tag title on saving tags in microweber/microweber

Record: CVE-2022-3245
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2022-6825 4.3

Record: EUVD-2022-6825
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gm8c-w9cm-c445 6.1

Microweber vulnerable to HTML Injection in create tag functionality

HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit f20abf30a1d9c1426c5fb757ac63998dc5b92bfc and is anticipated to be part of version 1.3.2.

Record: GHSA-gm8c-w9cm-c445
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79, CWE-94
Updated: 2026-11-02

NVD 6.1

Record: CVE-2022-3245
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-94, CWE-79
Updated: 2026-11-02

OSV 4.3

Code Injection in display of tag title on saving tags in microweber/microweber

Record: CVE-2022-3245
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-94
Updated: 2026-11-02

OSVGHSA-gm8c-w9cm-c445 6.1

Microweber vulnerable to HTML Injection in create tag functionality

Record: GHSA-gm8c-w9cm-c445
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79, CWE-94
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`microweber/microweber` Packagist	through 1.3.1	1.3.2
`microweber/microweber` Packagist	before 1.3.2, plus listed versions 0.9.3460.930.9310.9340.951 Show 27 moreShow less 1.0.31.0.41.0.51.0.61.0.71.1v1.2.10v1.2.11v1.2.12v1.2.13v1.2.14v1.2.15v1.2.16v1.2.17v1.2.18v1.2.19v1.2.20v1.2.21v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7v1.2.8v1.2.9v1.3.0v1.3.1	1.3.2

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3245 is a medium vulnerability (CVSS 4.3) in Microweber, published September 20, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in microweber/microweber 1.3.2.