CVE-2025-70791: Microweber Cross-site Scripting Vulnerability in Admin Order Endpoint
Summary
CVE-2025-70791: Microweber has a Cross-site Scripting vulnerability. Affects microweber/microweber versions < 2.0.20. Fixed in 2.0.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Microweber is an open-source content management system (CMS) designed for building websites and online stores. It provides a user-friendly interface and a range of features, including e-commerce capabilities, making it popular among developers and businesses. However, like many web applications, it can be susceptible to security vulnerabilities, such as Cross-site Scripting (XSS), which can compromise the integrity of the application and the security of its users.
Vulnerability Detail
The vulnerability is a Cross-site Scripting (XSS) flaw found in the '/admin/order/abandoned' endpoint of Microweber version 2.0.19. An attacker can exploit this vulnerability by manipulating the 'orderDirection' parameter in a specially crafted URL. If an admin user is tricked into visiting this URL, the attacker can execute arbitrary JavaScript code in the victim's browser, potentially leading to unauthorized actions or data theft. This vulnerability highlights the importance of input validation and sanitization in web applications.
How To Fix
Minimum fixed version
2.0.20
This is the first release that contains the fix.
composer require microweber/microweber:2.0.20Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the '/admin/order/abandoned' endpoint to trusted users only, or implement input validation to sanitize the 'orderDirection' parameter until the package is updated.
Conclusion
The Cross-site Scripting vulnerability in Microweber version 2.0.19 poses a significant risk to users with admin privileges. It is crucial to update to version 2.0.20 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for vulnerabilities in your open-source software.
See every vulnerability recorded for microweber/microweber →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and session.
If you are using Microweber version 2.0.19 or earlier, your installation is vulnerable. You can check your version in the admin dashboard or by inspecting the composer.lock file.
An attacker could execute arbitrary JavaScript in the browser of an admin user, leading to unauthorized actions, data theft, or further exploitation of the application.
Yes, Vulert is a service that monitors open-source vulnerabilities in your software using the composer.lock file. It provides real-time alerts for any vulnerabilities detected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for microweber/microweber.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
