Medium severity6.1NVD Advisory· Published Feb 5, 2026· Updated Jun 17, 2026
CVE-2025-70792
CVE-2025-70792
Description
Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
microweber/microweberPackagist | < 2.0.20 | 2.0.20 |
Affected products
3cpe:2.3:a:microweber:microweber:2.0.19:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microweber:microweber:2.0.19:*:*:*:*:*:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
4- github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7fnvdPatchWEB
- gist.github.com/TimRecktenwald/f4b0d1edbb87e75c17c639ca0bacba57nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-6w5w-jx4x-vjvwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-70792ghsaADVISORY
News mentions
0No linked articles in our index yet.