GCVE - cpe:2.3:a:microweber:microweber:2.0.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:microweber:microweber:2.0.0:*:*:*:*:*:*:*

part: a version: 2.0.0 update: *

Vendor	Microweber (`258278ac-42e3-5a44-848e-a62116cf50f6`)
Product	Microweber (`6be223c2-f9f1-5295-8b8f-5f1a82c03f9c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/microweber/microweber`	purl2cpe	2026-06-01 10:18:20.571252
`pkg:sourceforge/microweber.mirror`	purl2cpe	2026-06-01 10:18:20.571253

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-60954`	vulnerable	2026-06-08 07:37:27.428210	Details available Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts. Published: 2025-10-24T00:00:00.000Z Updated: 2025-10-24T20:40:52.388Z Open on db.gcve.eu Reference links https://github.com/microweber/microweber https://gist.github.com/progprnv/feae2b76f2db0cb2ac6e14b1bf7d8646 https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-60954	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-51504`	vulnerable	2026-06-08 07:31:11.225502	Details available Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. Published: 2025-08-01T00:00:00.000Z Updated: 2025-08-01T17:08:32.776Z Open on db.gcve.eu Reference links https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BLive%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md https://github.com/progprnv/CVE-Reports https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51504	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-51503`	vulnerable	2026-06-08 07:31:11.224936	Details available A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers. Published: 2025-07-31T00:00:00.000Z Updated: 2025-07-31T18:40:48.081Z Open on db.gcve.eu Reference links https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md https://github.com/progprnv/CVE-Reports https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51503	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-51502`	vulnerable	2026-06-08 07:31:11.224621	Details available Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users. Published: 2025-08-01T00:00:00.000Z Updated: 2025-08-01T18:01:25.783Z Open on db.gcve.eu Reference links https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Reflected%20XSS%20on%20layout%20parameter.md https://github.com/progprnv/CVE-Reports https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51502	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-51501`	vulnerable	2026-06-08 07:31:11.224108	Details available Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript. Published: 2025-08-01T00:00:00.000Z Updated: 2025-08-01T17:56:46.842Z Open on db.gcve.eu Reference links https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Reflected%20XSS%20on%20id%20parameter.md https://github.com/progprnv/CVE-Reports https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51501	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.