6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-70791

CVE-2025-70791: Microweber has a Cross-site Scripting vulnerability

Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-70791

CVE-2025-70791:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
microweber/microweber	composer	< 2.0.20	2.0.20

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described in CVE-2025-70791 is a Cross-site Scripting (XSS) issue in the '/admin/order/abandoned' endpoint of Microweber. The provided commit aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f directly addresses this vulnerability. The analysis of the patch shows that the abandoned function within the src/MicroweberPackages/Order/Http/Controllers/Admin/AbandonedOrderController.php file was modified to add input sanitization using the xss_clean function. Specifically, the $orderDirection variable, which is derived from the orderDirection request parameter, is now sanitized before being used. This confirms that the abandoned function was the location of the vulnerability. An attacker could have previously injected malicious JavaScript into the orderDirection parameter, leading to execution in a privileged user's browser. The commit also includes similar XSS fixes for other parts of the application, but the primary vulnerability described is located in the abandoned function.

Vulnerable functions

MicroweberPackages\Order\Http\Controllers\Admin\AbandonedOrderController::abandoned

src/MicroweberPackages/Order/Http/Controllers/Admin/AbandonedOrderController.php

The 'abandoned' function in the 'AbandonedOrderController' is vulnerable to Cross-site Scripting (XSS). The 'orderDirection' parameter is taken directly from the user's request and was used without proper sanitization. An attacker could provide a malicious script in this parameter, which would then be executed in the browser of an administrator viewing the abandoned orders page. The patch applies the 'xss_clean' function to this and other related parameters to mitigate the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.