CVE-2024-58289
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Script payloads in the first name field execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.
Risk Assessment
An authenticated attacker may execute arbitrary JavaScript in other users' browsers, potentially leading to session theft and unauthorized actions.
Recommendation
Update Microweber to a patched version and implement input validation and encoding in user profile fields.
Other vulnerabilities in Microweber
See all- CVE-2026-5696Medium
Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the 'group' parameter of the '/admin/settings' endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser.
- CVE-2026-12198High
In Microweber up to 2.0.20, a path traversal vulnerability exists in the userfiles_path function of /api_nosession/thumbnail_img via manipulation of the cache_path_relative argument. The attack can be launched remotely and the exploit is publicly available.
- CVE-2024-40101Medium
A reflected XSS vulnerability exists in Microweber 2.0.15 and earlier in the '/search' endpoint. An unauthenticated remote attacker can inject arbitrary web script or HTML via the 'keywords' parameter.
- CVE-2020-23136Medium
A vulnerability in Microweber v1.1.18 causes the user session not to expire after logout. This allows an attacker to reuse a valid session for unauthorized access.
Original NVD description (English source)
Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS