What’s Vulnerable › Vulnerabilities

CVE-2025-70791

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-05 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.

Affected products

• microweber/microweber: 2.0.19

References

• https://gist.github.com/TimRecktenwald/9615b9915a4cacda9f57bb57f13ab6d4
• https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f

Get alerted when CVE-2025-70791 or the next vulnerability affects your stack