Medium severity6.1NVD Advisory· Published Feb 5, 2026· Updated Jun 17, 2026
CVE-2025-70791
CVE-2025-70791
Description
Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
microweber/microweberPackagist | < 2.0.20 | 2.0.20 |
Affected products
3cpe:2.3:a:microweber:microweber:2.0.19:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microweber:microweber:2.0.19:*:*:*:*:*:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
4- github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7fnvdPatchWEB
- gist.github.com/TimRecktenwald/9615b9915a4cacda9f57bb57f13ab6d4nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-5jg5-xqfw-rv92ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-70791ghsaADVISORY
News mentions
0No linked articles in our index yet.