CVE-2025-70791

6.1 mediumEPSS 0.3%

Medium (6.1) in microweber microweber. EPSS 0.3% chance of exploitation in the next 30 days.

Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-02-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

microweber:microweber

References

https://gist.github.com/TimRecktenwald/9615b9915a4cacda9f57bb57f13ab6d4
https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f

Check your stack JSON