CVE-2020-13405: Microweber Unauthenticated User Database Disclosure

CVE-2020-13405 is an information disclosure vulnerability in Microweber, an open-source CMS, affecting all versions prior to 1.1.20. The flaw is located in the endpoint userfiles/modules/users/controller/controller.php, which fails to properly validate POST requests to the /modules/ path. An unauthenticated attacker can exploit this lack of validation to directly access the database containing user data, including credentials.

The vulnerability has a CVSS score of 7.5, classified as High severity. It was registered in the National Vulnerability Database on July 16, 2020. Significantly, on November 8, 2026, public GitHub repositories containing working Proof of Concept exploits were confirmed: a concrete signal of renewed attention from the security community toward this flaw still present in active deployments.

Microweber administrators must immediately verify the installed version and, if below 1.1.20, proceed with urgent update. A thorough review of server access logs is critical to identify potential unauthorized access to the /modules/ path indicating active exploitation of this flaw. Implementing additional access controls and monitoring on this endpoint is priority until patch deployment is completed.