CVE-2024-58289

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-27)

CWE

CWE-79

Published

2025-12-11

Modified

2026-10-27

Record from

the NVD, synced 2026-10-27

Affected

• microweber:microweber

References

• https://github.com/microweber/microweber
• https://microweber.me/
• https://www.exploit-db.com/exploits/52058
• https://www.vulncheck.com/advisories/microweber-stored-cross-site-scripting-via-user-profile-fields

Check your stackJSON