High · 7.6 CVE-2025-51503 EUVD-2025-23298GHSA-782f-gxj5-xvqc

Microweber Has Stored XSS Vulnerability in User Profile Fields

Published Jul 31, 2025 · Updated Jul 31, 2025 · Assigned by mitre

Package: microweber/microweber Ecosystem: Packagist

Description

A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	microweber/microweber	>= 2.0.0, <= 2.0.19	—	GHSA-782f-gxj5-xvqc

References

https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md
https://github.com/progprnv/CVE-Reports
https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51503