CVE-2025-51501
published 2025-08-01CVE-2025-51501: Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary…
PriorityP337medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
0.72%
49.4th percentile
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microweber | microweber | — | — |
| microweber | microweber | 2.0.0 – 2.0.19 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Microweber has Reflected XSS Vulnerability in the id Parameter
osv·2025-08-01
CVE-2025-51501 [MEDIUM] Microweber has Reflected XSS Vulnerability in the id Parameter
Microweber has Reflected XSS Vulnerability in the id Parameter
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
GHSA
Microweber has Reflected XSS Vulnerability in the id Parameter
ghsa·2025-08-01
CVE-2025-51501 [MEDIUM] CWE-79 Microweber has Reflected XSS Vulnerability in the id Parameter
Microweber has Reflected XSS Vulnerability in the id Parameter
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
No detection rules found.
Nuclei
Microweber CMS2.0 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2025-51501 [MEDIUM] Microweber CMS2.0 - Cross-Site Scripting
Microweber CMS2.0 - Cross-Site Scripting
Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
Template:
id: CVE-2025-51501
info:
name: Microweber CMS2.0 - Cross-Site Scripting
author: nukunga
severity: medium
description: |
Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
impact: |
Authenticated attackers can execute arbitrary JavaScript in victim browsers through the id parameter in the module_settings API, potentially leading to session hijacking.
remediation: |
Upgrade Microweber CMS to a version later than 2.0 that properly sanitizes the id paramet
No writeups or analysis indexed.
2025-08-01
Published