GCVE - cpe:2.3:a:microweber:microweber:2.0.19:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:microweber:microweber:2.0.19:*:*:*:*:*:*:*

part: a version: 2.0.19 update: *

Vendor	Microweber (`258278ac-42e3-5a44-848e-a62116cf50f6`)
Product	Microweber (`6be223c2-f9f1-5295-8b8f-5f1a82c03f9c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/microweber/microweber`	purl2cpe	2026-06-01 10:18:20.571263
`pkg:sourceforge/microweber.mirror`	purl2cpe	2026-06-01 10:18:20.571264

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-70792`	vulnerable	2026-06-08 07:43:17.018951	Details available Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20. Published: 2026-02-05T00:00:00.000Z Updated: 2026-02-05T20:50:03.356Z Open on db.gcve.eu Reference links https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f https://gist.github.com/TimRecktenwald/f4b0d1edbb87e75c17c639ca0bacba57	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-70791`	vulnerable	2026-06-08 07:43:17.018598	Details available Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20. Published: 2026-02-05T00:00:00.000Z Updated: 2026-02-05T20:53:48.883Z Open on db.gcve.eu Reference links https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f https://gist.github.com/TimRecktenwald/9615b9915a4cacda9f57bb57f13ab6d4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2214`	vulnerable	2026-06-08 07:16:56.414004	Microweber Settings index.php cross site scripting LOW (3.5) A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/website_group/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-03-11T23:31:04.357Z Updated: 2025-03-12T13:37:18.961Z Open on db.gcve.eu Reference links https://vuldb.com/?id.299285 https://vuldb.com/?ctiid.299285 https://vuldb.com/?submit.512032 https://github.com/Fewword/Poc/blob/main/microweber/mwb-poc1.md	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.