Listen to this Post
How the CVE Works
The vulnerability exists in the `live_edit.module_settings` API endpoint of Microweber CMS (versions 2.0.0 to 2.0.19). An attacker can inject malicious JavaScript code via the `id` parameter, which is reflected in the server’s response without proper sanitization. When a victim visits a crafted URL containing the payload, the script executes in their browser, leading to session hijacking, defacement, or other client-side attacks. The lack of input validation and output encoding enables this classic reflected XSS flaw.
DailyCVE Form
Platform: Microweber CMS
Version: 2.0.0 – 2.0.19
Vulnerability: Reflected XSS
Severity: Moderate
Date: Aug 1, 2025
Prediction: Patch by Sep 2025
What Undercode Say
Analytics:
curl -X GET "http://target/api/live_edit.module_settings?id=<script>payload</script>"
fetch(<code>/api/live_edit.module_settings?id=${encodeURIComponent('<img src=x onerror=alert(1)>')}</code>);
Exploit:
Craft a malicious link:
http://vulnerable-site.com/api/live_edit.module_settings?id=<script>alert(document.cookie)</script>
Protection from this CVE:
- Sanitize `id` parameter input.
- Implement CSP headers.
- Upgrade when patched.
Impact:
- Session hijacking.
- Unauthorized actions.
- Data theft.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
