Microweber Microweber vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Microweber Microweber: 5 record(s), with affected versions and fixes.cpe:2.3:a:microweber:microweber
CVE-2025-70792
Medium · 6.1
CWE-79 Feb 5, 2026
Cross-site Scripting (XSS) in Microweber
Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
CVE-2025-70791
Medium · 6.1
CWE-79 Feb 5, 2026
Cross-site Scripting (XSS) in Microweber
Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
CVE-2024-58289
Medium · 5.4
CWE-79 Dec 11, 2025
Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields
Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.
CVE-2025-60954
High · 8.3
CWE-521 Oct 24, 2025
Weak Password Requirements in Microweber
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts.
CVE-2025-34076
High · 7.2
Public exploit CWE-22 Jul 2, 2025
Microweber CMS Authenticated Local File Inclusion via Backup API
An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.