PT-2026-6597 · Unknown · Microweber

Publicado 2026-02-05 · Atualizado 2026-02-06 · CVE-2025-70792

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microweber versions prior to 2.0.20

Description A Cross-Site Scripting issue exists in the /admin/category/create API endpoint. An attacker can manipulate the rel id parameter within a crafted URL. By enticing a user with administrative privileges to visit the malicious URL, the attacker can execute JavaScript code in the victim's browser.

Recommendations Update to version 2.0.20 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-70792

GHSA-6W5W-JX4X-VJVW

Produtos afetados

Microweber

Referências · 8

• 🔥 https://gist.github.com/TimRecktenwald/f4b0d1edbb87e75c17c639ca0bacba57 · Exploit
• https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f · Correção
• https://github.com/microweber/microweber · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-70792 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1qxjol3/resumen_diario_de_vulnerabilidades_06022026 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2019472442557661541 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-6w5w-jx4x-vjvw · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-70792 · Aviso do Fabricante