CVE-2022-0926 (PHP, published 2022-03-12T10:15Z)
Description: value: File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Utils/System/Files.php
Commit message: Update Files.php


Vulnerable code:

Fixed code:
            'key',
            'asax',
            'btapp',
            'xd',
            'fwtemplate',
            'crdownload',
            'whtt',
            'ssp',
            'fmp',
            'jspa',
            'obml16',
            'a5w',
            'crt',
            'vrt',
            'website',
            'p7c',
            'dll',
            'php',
            'mjs',
            'dhtml',
            'xul',
            'bml',
            'download',
            'cshtml',
            'vsdisco',
            'codasite',
            'webbookmark',
            'rjs',
            'wsdl',
            'dml',
            'aro',
            'dcr',
            'shtml',
            'dochtml',
            'dwt',
            'spc',
            'a4p',
            'htaccess',
            'ascx',
            'pac',
            'p7b',
            'xhtm',
            'oam',
            'site',
            'kit',
            'aspx',
            'zul',
            'tpl',
            'htm',
            'seam',
            'svr',
            'pem',
            'url',
            'dap',
            'appcache',
            'chm',
            'wbs',
            'htc',
            'ewp',
            'gsp',
            'asr',
            'der',
            'master',
            'stc',
            'ap',
            'html',
            'p12',
            'xpd',
            'fwp',
            'epibrw',
            'strm',
            'xss',
            'node',
            'disco',
            'gsp',
            'pro',
            'rss',
            'gne',
            'sdb',
            'compressed',
            'asp',
            'browser',
            'php2',
            'sites2',
            'dothtml',
            'bok',
            'axd',
            'nzb',
            'vdw',
            'obml',
            'mhtml',
            'ashx',
            'con',
            'rhtml',
            'alx',
            'opml',
            'web',
            'chat',
            'csr',
            'do',
            'sht',
            'asa',
            'cha',
            'h5p',
            'qf',
            'olp',
            'hyperesources',
            'sparkle',
            'razor',
            'php4',
            'cms',
            'mml',
            'jnlp',
            'har',
            'br',
            'webloc',
            'srf',
            'cer',
            'uhtml',
            'pptmhtml',
            'phtml',
            'xbel',
            'cfm',
            'fwtemplateb',
            'jspx',
            'jsp',
            'xfdl',
            'zhtml',
            'stml',
            'jsonl',
            'maff',
            'dbm',
            'aex',
            'crl',
            'mht',
            'wml',
            'sass',
            'xht',
            'awm',
            'page',
            'hdml',
            'webmanifest',
            'itms',
            'sitemap',
            'shtm',
            'wpp',
            'jss',
            'oth',
            'ucf',
            'prf',
            'freeway',
            'edge',
            'iqy',
            'vrml',
            'mvc',
            'wdgt',
            'discomap',
            'psp',
            'hxs',
            'adr',
            'hype',
            'csp',
            'xhtml',
            'webarchive',
            'qbo',
            'jhtml',
            'svc',
            'phtm',
            'rw3',
            'tpl',
            'stl',
            'wbxml',
            'p7',
            'ndjson',
            'ognc',
            'fwtb',
            'muse',
            'vbd',
            'sites',
            'rt',
            'esproj',
            'private',
            'srl',
            'zhtml',
            'vbhtml', 
            'hypetemplate',
            'obml15',
            'hypesymbol',
            'pub',
            'ece',
            'mspx',
            'docmhtml',
            'xws',
            'wgp',
            'tvpi',
            'woa',
            'asmx',
            'xbl',
            'webhistory',
            'idc',
            'jws',
            'lbc',
            'att',
            'tvvi',
            'zvz',
            'php3',
            'webarchivexml',
            'widget',
            'swz',
            'qrm',
            'bwp',
            'atom',
            'cdf',
            'map',
            'hdm',
            'php5',
            'rwsw',
            'wgt',
            'nod',
            'rflw',
            'htx',
            'mvr',
            'an',
            'rwp',
            'lasso',
            'vlp',
            'stp',
            'nxg',
            'faces',
            'kcmsf',
            'ptw',
            'less',
            'saveddeck',
            'ccbjs',
            'wn',
            'ppthtml',
            'jcz',
            'jvs',
            'rwtheme',
            'jst',
            'mapx',
            'cpg',
            'wpx',
            'qbx',
            'suck',
            'iwdgt',
            'public',
            'cphd',
            'moz',
            'zfo',
            'stm',
            'fcgi',
            'itpc',
            'cfml'