CVE-2025-51501

MEDIUMNuclei

Microweber has Reflected XSS Vulnerability in the id Parameter

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2025-51501 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 1, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

microweber/microweber

Browse Packagist / microweber/microweber
GitHub Advisory2.0.0 to ≤ 2.0.19affected

Nuclei templates

1
ProjectDiscoveryMEDIUMMicroweber CMS2.0 - Cross-Site Scripting

Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.

Impact

Authenticated attackers can execute arbitrary JavaScript in victim browsers through the id parameter in the module_settings API, potentially leading to session hijacking.

Remediation

Upgrade Microweber CMS to a version later than 2.0 that properly sanitizes the id parameter in live_edit endpoints.

Authorsnukunga
Template tagscvecve2025microweberxssauthenticatedvuln
Shodan: http.title:"Microweber"
https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51501 https://nvd.nist.gov/vuln/detail/CVE-2025-51501

Source: ProjectDiscovery

References

5