CVE-2025-51502

MEDIUMNuclei

Microweber has Reflected XSS Vulnerability in the layout Parameter

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2025-51502 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 1, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

microweber/microweber

Browse Packagist / microweber/microweber
GitHub Advisory2.0.0 to ≤ 2.0.19affected

Nuclei templates

1
ProjectDiscoveryMEDIUMMicroweber CMS 2.0 - Reflected XSS in Admin Page Creation

Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.

Impact

Authenticated attackers can execute arbitrary JavaScript in victim browsers through the layout parameter in page creation, potentially enabling session hijacking and credential theft.

Remediation

Upgrade Microweber CMS to a version later than 2.0 that properly sanitizes the layout parameter.

Authorsnukunga
Template tagscvecve2025microweberxssauthenticatedvuln
Shodan: http.title:"Microweber"
https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51502 https://nvd.nist.gov/vuln/detail/CVE-2025-51502

Source: ProjectDiscovery

References

5