Microweber has Reflected XSS Vulnerability in the layout Parameter

MÉDIO 6.1CVE-2025-51502 · GHSA-mvj3-hc7j-vp74 · Published 01/08/2025 · updated 17/06/2026

Em resumo

CVE-2025-51502 é uma vulnerabilidade MÉDIO (CVSS 6.1) que afeta microweber/microweber, microweber (microweber).
Chance de exploração nos próximos 30 dias (EPSS): 0.86%, maior que 58.5% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
microweber/microweber Packagist	`≥ 2.0.0, ≤ 2.0.19`	No fix yet
microweber microweber	`= 2.0.0`	No fix yet

Description

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

NVD description

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

References

nvd.nist.gov/vuln/detail/CVE-2025-51502 · ADVISORY
microweber/microweber · PACKAGE
progprnv/CVE-Reports · WEB
progprnv/CVE-Reports · WEB
progprnv/CVE-Reports · WEB

Mais vulnerabilidades de microweber/microweber

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

microweber/microweber

Packagist

≥ 2.0.0, ≤ 2.0.19

No fix yet

microweber

= 2.0.0

No fix yet

Description

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

NVD description

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

Mais vulnerabilidades de microweber/microweber

Ver tudo →