Vulnerability · Published Dec 11, 2025 · Assigned by VulnCheck

CVE-2024-58289Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields

Medium 5.3

In plain English

A medium-severity cross-site scripting in Microweber from microweber. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 82.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.

Affected products (as reported)

Vendor	Product	Versions
microweber	Microweber	2.0.15

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

ExploitDB-52058 exploit
Microweber Homepage product
Microweber GitHub Repository product
VulnCheck Advisory: Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields third-party-advisory