CVE-2025-51503

Microweber Has Stored XSS Vulnerability in User Profile Fields

7.6 High

A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: Low

Exploit likelihood

0.58%Up 0.5 points since Aug 1, 2025

What each source reports

CVE List Score used 7.6

Record: CVE-2025-51503
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2025-23298 7.6

Record: EUVD-2025-23298
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-782f-gxj5-xvqc 1.9

Microweber Has Stored XSS Vulnerability in User Profile Fields

Record: GHSA-782f-gxj5-xvqc
CVSS 4.0: 1.9 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P
Weakness: CWE-79
Updated: 2026-11-02

NVD 7.6

Record: CVE-2025-51503
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

OSV 7.6

Record: CVE-2025-51503
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Updated: 2026-11-02

OSVGHSA-782f-gxj5-xvqc 1.9

Microweber Has Stored XSS Vulnerability in User Profile Fields

Record: GHSA-782f-gxj5-xvqc
CVSS 4.0: 1.9 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P
Weakness: CWE-79
Updated: 2026-11-02

Affected products

microweber

Affected packages

Affected packages
Package	Affected	Fixed
`microweber/microweber` Packagist	2.0.0 to 2.0.19	None known
`microweber/microweber` Packagist	2.0.0 to 2.0.19, plus listed versions v2.0.0v2.0.1v2.0.10v2.0.11v2.0.12 Show 14 moreShow less v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-51503 is a high vulnerability (CVSS 7.6) in Microweber, published July 31, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. No source names a fixed version.