GHSA-782f-gxj5-xvqc

Microweber Has Stored XSS Vulnerability in User Profile Fields

Source: GitHub Advisory Database (reviewed) Low CVE-2025-51503

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	microweber/microweber	>= 2.0.0, <= 2.0.19	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-51503 advisory
https://github.com/microweber/microweber package
https://github.com/progprnv/CVE-Reports web
https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51503 web
https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md web