CVE-2023-5244 (PHP, published 2023-09-28T01:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
userfiles/modules/microweber/toolbar/editor_tools/rte_image_editor/index.php
Commit message: update


Vulnerable code:



            }
            else {
        if(window.thismodal) {
                    if(mw.parent().image.currentResizing){
                        if(mw.parent().iframecallbacks['insert_image']) {
                    if(mw.parent().image.currentResizing && mw.parent().image.currentResizing){
            if(mw.parent().image.currentResizing && mw.parent().image.currentResizing[0]) {
            if(window.thismodal) {
            element:'#filepick',

            }
            else if (filetypes === 'videos' || filetypes === 'media') {
            }
            else if (filetypes === 'files') {
            if(window.thismodal) {


                }
                else if (filetypes === 'videos' || filetypes === 'media') {
                }
                else if (filetypes === 'files') {
                if(window.thismodal) {

                        if(window.thismodal) {
                        if(window.thismodal) {
            if(window.thismodal) {
            if(mw.parent().image.currentResizing) {
            if(mode === 'dialog' && index > 0) {
                    }, {'filetype':'images'});
             }
            if(window.thismodal){
                if(this.selectedIndex === ($(selector).length - 1)){
                } else if(this.selectedIndex === 2){
<style >
/*    body, html {
        overflow: hidden;
    }*/
    .image-tabs-header > div h6{
    .image-tabs-header{

Fixed code:
    $types = xss_clean($types);
    $title = xss_clean($title);
            } else {
        if (window.thismodal) {
                    if (mw.parent().image.currentResizing) {
                        if (mw.parent().iframecallbacks['insert_image']) {
                    if (mw.parent().image.currentResizing && mw.parent().image.currentResizing) {
            if (mw.parent().image.currentResizing && mw.parent().image.currentResizing[0]) {
            if (window.thismodal) {
            element: '#filepick',
            } else if (filetypes === 'videos' || filetypes === 'media') {
            } else if (filetypes === 'files') {
            if (window.thismodal) {
                } else if (filetypes === 'videos' || filetypes === 'media') {
                } else if (filetypes === 'files') {
                if (window.thismodal) {
                        if (window.thismodal) {
                        if (window.thismodal) {
            if (window.thismodal) {
            if (mw.parent().image.currentResizing) {
            if (mode === 'dialog' && index > 0) {
                    }, {'filetype': 'images'});
            }
            if (window.thismodal) {
                if (this.selectedIndex === ($(selector).length - 1)) {
                } else if (this.selectedIndex === 2) {
<style>
    /*    body, html {
            overflow: hidden;
        }*/

    .image-tabs-header > div h6 {

    .image-tabs-header {