CVE-2025-51503

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-51503
A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.

7.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/progprnv/CVE-Reports Third Party Advisory
https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51503 Third Party Advisory
https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:microweber:microweber:2.0.0:*:*:*:*:*:*:*
History

06 Aug 2025, 16:21

Type Values Removed Values Added
CPE cpe:2.3:a:microweber:microweber:2.0.0:*:*:*:*:*:*:*
References () https://github.com/progprnv/CVE-Reports - () https://github.com/progprnv/CVE-Reports - Third Party Advisory
References () https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51503 - () https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51503 - Third Party Advisory
References () https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md - () https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md - Broken Link
Summary
  • (es) Una vulnerabilidad de Cross-site Scripting (XSS) almacenado en Microweber CMS 2.0 permite a los atacantes inyectar scripts maliciosos en los campos del perfil del usuario, lo que provoca la ejecución arbitraria de JavaScript en los navegadores del administrador.
First Time Microweber microweber
Microweber

31 Jul 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.6
CWE CWE-79

31 Jul 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-31 18:15

Updated : 2025-08-06 16:21

NVD link : CVE-2025-51503

Mitre link : CVE-2025-51503

CVE.ORG link : CVE-2025-51503

JSON object : View

Products Affected

microweber

  • microweber
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')