6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-51502

CVE-2025-51502: Microweber has Reflected XSS Vulnerability in the layout Parameter

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-51502

CVE-2025-51502:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
microweber/microweber	composer	>= 2.0.0, <= 2.0.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

I am currently investigating a Cross-Site Scripting (XSS) vulnerability in Microweber CMS and have hit a roadblock. The public advisories and provided links do not contain a direct reference to the security patch, and my initial attempts to locate the proof-of-concept have been unsuccessful due to a broken link.

To proceed with the analysis and identify the vulnerable functions, I need to manually find the commit that addresses this vulnerability. I will start by examining the repository's tags to pinpoint the commits related to the vulnerable versions. This will allow me to systematically search the commit history for keywords such as "XSS," "security," or "layout," which are associated with the vulnerability.

If this approach does not yield the patch, I will broaden my search by exploring the repository for code related to the vulnerable page and parameter. This methodical approach will help me isolate the exact code changes that mitigate the XSS flaw, and ultimately, identify the functions that were vulnerable to exploitation. I will keep you updated on my progress.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.