Microweber has Reflected XSS Vulnerability in the layout Parameter

MEDIUM 6.1CVE-2025-51502 · GHSA-mvj3-hc7j-vp74 · Published 01/08/2025 · updated 17/06/2026

In short

CVE-2025-51502 is a MEDIUM (CVSS 6.1) vulnerability affecting microweber/microweber, microweber (microweber).
Chance of exploitation in the next 30 days (EPSS): 0.86%, higher than 58.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
microweber/microweber Packagist	`≥ 2.0.0, ≤ 2.0.19`	No fix yet
microweber microweber	`= 2.0.0`	No fix yet

Description

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

NVD description

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

References

nvd.nist.gov/vuln/detail/CVE-2025-51502 · ADVISORY
microweber/microweber · PACKAGE
progprnv/CVE-Reports · WEB
progprnv/CVE-Reports · WEB
progprnv/CVE-Reports · WEB

More vulnerabilities in microweber/microweber

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

microweber/microweber

Packagist

≥ 2.0.0, ≤ 2.0.19

No fix yet

microweber

= 2.0.0

No fix yet

Description

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

NVD description

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

More vulnerabilities in microweber/microweber

See all →