CVE-2025-51504

HIGH

Microweber CMS 2.0 - Stored Cross-Site Scripting via Last Name Field

Title source: llm

Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.

Core 3

Core References

Third Party Advisory

Exploit, Third Party Advisory

Broken Link

CVSS v3 7.6

EPSS 0.0046

EPSS Percentile 36.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-79

Status published

Products (2)

microweber/microweber 2.0.0

microweber/microweber 2.0.0Packagist

Published Aug 01, 2025

Tracked Since Feb 18, 2026