PT-2026-6597 · Unknown · Microweber

Published 2026-02-05 · Updated 2026-02-06 · CVE-2025-70792

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microweber versions prior to 2.0.20

Description A Cross-Site Scripting issue exists in the /admin/category/create API endpoint. An attacker can manipulate the rel id parameter within a crafted URL. By enticing a user with administrative privileges to visit the malicious URL, the attacker can execute JavaScript code in the victim's browser.

Recommendations Update to version 2.0.20 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-70792

GHSA-6W5W-JX4X-VJVW

Affected Products

Microweber

References · 8

• 🔥 https://gist.github.com/TimRecktenwald/f4b0d1edbb87e75c17c639ca0bacba57 · Exploit
• https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-70792 · Security Note
• https://osv.dev/vulnerability/GHSA-6w5w-jx4x-vjvw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-70792 · Vendor Advisory
• https://github.com/microweber/microweber · Note
• https://reddit.com/r/VulnMatter/comments/1qxjol3/resumen_diario_de_vulnerabilidades_06022026 · Reddit Post
• https://twitter.com/CVEnew/status/2019472442557661541 · Twitter Post