CVE-2025-70792

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-05 · updated 2026-06-17
Weakness: CWE-79

Description

Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.

Affected products

microweber/microweber: 2.0.19

References

https://gist.github.com/TimRecktenwald/f4b0d1edbb87e75c17c639ca0bacba57
https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f

Get alerted when CVE-2025-70792 or the next vulnerability affects your stack