CVE-2025-70792
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Feb 5, 2026
CISA due date
—
The record
Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | microweber/microweber | 0 | 2.0.20 |
Related vulnerabilities
- GHSA-6w5w-jx4x-vjvw Microweber Cross-site Scripting vulnerability Same vulnerability
- GHSA-5jg5-xqfw-rv92 Microweber has a Cross-site Scripting vulnerability Also affects microweber/microweber
- CVE-2025-70791 Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber… Also affects microweber/microweber
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79