CVE-2025-51502: Microweber CMS Reflected XSS Vulnerability in Layout Parameter
Summary
CVE-2025-51502: Microweber has Reflected XSS Vulnerability in the layout Parameter. Affects microweber/microweber versions >= 2.0.0, <= 2.0.19. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microweber is an open-source content management system (CMS) designed for creating websites and online stores. It offers a user-friendly interface, customizable templates, and a variety of features for managing content. However, like many web applications, it can be susceptible to security vulnerabilities, including cross-site scripting (XSS) attacks, which can compromise the integrity of the application and its users.
Vulnerability Detail
The vulnerability identified as CVE-2025-51502 is a reflected cross-site scripting (XSS) flaw present in Microweber CMS version 2.0.0 to 2.0.19. This vulnerability arises from improper handling of the 'layout' parameter on the '/admin/page/create' page. An attacker can exploit this flaw to execute arbitrary JavaScript in the context of authenticated admin users, potentially leading to unauthorized actions, data exposure, or session hijacking. The severity of this vulnerability is rated as moderate, with a CVSS score of 6.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can sanitize the input for the 'layout' parameter to prevent the execution of malicious scripts. This can be done by implementing input validation and encoding mechanisms in the application code to ensure that any user input is properly escaped before being rendered on the page.
Conclusion
In summary, CVE-2025-51502 is a reflected XSS vulnerability in Microweber CMS that affects versions 2.0.0 to 2.0.19. Users are advised to update to the latest version to mitigate the risk. Additionally, implementing input validation can serve as a temporary workaround while the update is performed.
See every vulnerability recorded for microweber/microweber →
FAQ
CVE-2025-51502 is a reflected XSS vulnerability in Microweber CMS that allows attackers to execute arbitrary JavaScript in the context of authenticated admin users.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application's composer.lock file without any signup.
The risks include unauthorized actions by attackers, data exposure, and potential session hijacking, which can compromise the security of the application and its users.
To update Microweber, run the command 'composer update microweber/microweber' in your terminal to install the latest patched version.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. It helps you stay informed about potential security issues.
Related vulnerabilities
Recent vulnerabilities recorded for microweber/microweber.
