IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-02-05 17:16

MODIFIED

2026-02-05 17:16

EPSS (Prob. Exploit)

0.31%

Top 75.9%

DATA SOURCES:

NVD 🔗 2026-02-05 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-6w5w-jx4x-vjvw LOW

Microweber Cross-site Scripting vulnerability

AFFECTED PACKAGES:

COMPOSER / microweber/microweber

< 2.0.20

Fixed in: 2.0.20

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

2 versions affected

ALIASES:

GHSA-6w5w-jx4x-vjvw

> HISTORIQUE DES MODIFICATIONS

Première apparition

05/02/2026 17:16

Source: NVD

Total des modifications: 0 Dernière mise à jour: 9 months ago

> REFERENCES

https://gist.github.com/TimRecktenwald/f4b0d1edbb87e75c17c639ca0bacba57

https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3e...