CVE-2024-58289

Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields

CVSS 5.3 MEDIUMEPSS 0.2%CWE-79

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.3EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

11 dez 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Produtos afetados

microweber · Microweber

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/microweber/microweber https://microweber.me/https://www.exploit-db.com/exploits/52058 https://www.vulncheck.com/advisories/microweber-stored-cross-site-scripting-via-user-profile-fields