| शीर्षक | Microweber 2.0.20 Cross Site Scripting |
|---|
| विवरण | A stored cross-site scripting vulnerability exists in Microweber v2.0.20. The user profile editing functionality at /admin/users/<user-id>/edit does not safely handle attacker-controlled values placed into the First Name and Last Name fields. A user with permission to edit another user's profile can store a crafted payload, which is later rendered as part of the victim user's display name without sufficient output encoding. This allows JavaScript execution in another authenticated user's browser. The issue was privately reported to the vendor by email in early April 2026. As of May 14, 2026, no vendor response has been received. Public technical references are provided for CNA/VulDB review.
|
|---|
| स्रोत | ⚠️ https://github.com/whuHouYF/microweber-vuldb-disclosure-2026/blob/991630c494a99c70a96e456992a04de2ecb5a1e1/reports/microweber-xss.md |
|---|
| उपयोगकर्ता | TarryHou (UID 97936) |
|---|
| सबमिशन | 14/05/2026 11:52 AM (5 महीनों पहले) |
|---|
| संयम | 14/06/2026 09:08 AM (1 month later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 336056 [Microweber 2.0.15 क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|