Microweber XSS Vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2018-19917 · ADVISORY
• microweber/microweber · PACKAGE
• netsparker.com/web-applications-advisories/ns-18-038-reflected-cross-site-scripting-in-microweber · WEB
• packetstormsecurity.com/files/151005/Microweber-1.0.8-Cross-Site-Scripting.html · WEB
• seclists.org/fulldisclosure/2019/Jan/12 · WEB
• seclists.org/fulldisclosure/2019/Jan/25 · WEB
• microweber/microweber · Third Party Advisory
• netsparker.com/web-applications-advisories/ns-18-038-reflected-cross-site-scripting-in-microweber · Third Party Advisory

More vulnerabilities in microweber/microweber

• CVE-2026-12198HIGH 7.3A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img…
• CVE-2025-70792MEDIUM 6.1Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" pa…
• CVE-2025-70791MEDIUM 6.1Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirec…
• CVE-2025-51504HIGH 7.6Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.
• CVE-2025-51502MEDIUM 6.1Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScri…