IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-02-05 17:16

MODIFIED

2026-02-05 17:16

EPSS (Prob. Exploit)

0.31%

Top 76.3%

DATA SOURCES:

NVD 🔗 2026-02-05 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-5jg5-xqfw-rv92 LOW

Microweber has a Cross-site Scripting vulnerability

AFFECTED PACKAGES:

COMPOSER / microweber/microweber

< 2.0.20

Fixed in: 2.0.20

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

2 versions affected

ALIASES:

GHSA-5jg5-xqfw-rv92

> HISTORIQUE DES MODIFICATIONS

Première apparition

05/02/2026 17:16

Source: NVD

Total des modifications: 0 Dernière mise à jour: 9 months ago

> REFERENCES

https://gist.github.com/TimRecktenwald/9615b9915a4cacda9f57bb57f13ab6d4

https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3e...