CVE-2020-23136Medium· 5.5▾ SunlitMicroweber v1.1.18 is affected by no session expiry after log-out.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Microweber v1.1.18 is affected by no session expiry after log-out.
microweber = 1.1.18Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-34076High· 7.2An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API
CVE-2025-54547Medium· 5.3On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired
CVE-2026-5696Medium· 5.9Reflected Cross-Site Scripting (XSS) in Microweber
CVE-2026-5695High· 8.4Arbitrary file upload vulnerability due to a lack of proper validation in upload forms
CVE-2026-118665HighGraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
CVE-2026-116894Medium· 4.2REDAXO before 5.21.5 Insufficient Session Expiration on Password Change