Medium severity · published Dec 11, 2025
CVE-2024-58289
Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Microweber · microweber
2.0.15 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-58289
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-58289
Product
https://github.com/microweber/microweber
Broken Link
https://microweber.me/
Exploit
https://www.exploit-db.com/exploits/52058
Third Party Advisory
https://www.vulncheck.com/advisories/microweber-stored-cross-site-scripting-via-user-profile-fields
More from Microweber
9.8
CVE-2023-1877
Command Injection in microweber/microweber
9.8
CVE-2022-2368
Authentication Bypass by Spoofing in microweber/microweber
9.8
CVE-2022-0895
Static Code Injection in microweber/microweber
9.8
CVE-2020-23138
An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page
8.8
CVE-2023-49052
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component