Microweber Cross-site Scripting vulnerability

MEDIUM 4.7CVE-2024-33299 · GHSA-97h9-p9f8-4p3r · Published 10/01/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
microweber/microweber Packagist	`≤ 2.0.9`	No fix yet
microweber microweber	`≤ 2.0.9`	No fix yet

Description

Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users

NVD description

Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users

References

nvd.nist.gov/vuln/detail/CVE-2024-33299 · ADVISORY
MathSabo/CVE-2024-33299 · WEB
microweber/microweber · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free