CVE-2025-2214— Microweber Settings index.php cross site scripting
Quick assessment
Affected
n/a Microweber
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Microweber是Microweber开源的一套可提供拖拽功能的网上商店管理系统。该系统包括添加商品、图片等模块。 Microweber 2.0.19版本存在安全漏洞，该漏洞源于对参数group的错误操作会导致跨站脚本攻击。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-2214
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Microweber Settings index.php cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/website_group/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Microweber 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microweber是Microweber开源的一套可提供拖拽功能的网上商店管理系统。该系统包括添加商品、图片等模块。 Microweber 2.0.19版本存在安全漏洞，该漏洞源于对参数group的错误操作会导致跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Microweber | 2.0.19 | - |
|
II. Public POCs for CVE-2025-2214
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-2214
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-2214 (3)
-
-
Submit #512032: Microweber 2.0.19 Cross Site Scripting third-party-advisory
-
Proof of Concept for CVE-2025-2214 (1)
Same Patch Batch · n/a · 2025-03-11 · 24 CVEs total
| CVE-2025-2177 | 7.3 HIGH | libzvbi search.c vbi_search_new integer overflow |
| CVE-2025-2176 | 7.3 HIGH | libzvbi io-sim.c vbi_capture_sim_load_caption integer overflow |
| CVE-2025-2193 | 5.4 MEDIUM | MRCMS org.marker.mushroom.controller.FileController delete.do delete path traversal |
| CVE-2025-2174 | 5.3 MEDIUM | libzvbi conv.c vbi_strndup_iconv_ucs2 integer overflow |
| CVE-2025-2173 | 5.3 MEDIUM | libzvbi conv.c vbi_strndup_iconv_ucs2 uninitialized pointer |
| CVE-2025-2215 | 4.7 MEDIUM | Doufox s=doudou path traversal |
| CVE-2025-2175 | 4.3 MEDIUM | libzvbi _vbi_strndup_iconv integer overflow |
| CVE-2025-2196 | 3.5 LOW | MRCMS org.marker.mushroom.controller.FileController upload.do upload cross site scripting |
| CVE-2025-2195 | 3.5 LOW | MRCMS org.marker.mushroom.controller.FileController rename.do rename cross site scripting |
| CVE-2025-2194 | 3.5 LOW | MRCMS org.marker.mushroom.controller.FileController list.do list cross site scripting |
| CVE-2025-25927 | OpenMRS 跨站请求伪造漏洞 | |
| CVE-2025-25928 | OpenMRS 跨站请求伪造漏洞 | |
| CVE-2024-51319 | Zucchetti Ad Hoc Infinity 安全漏洞 | |
| CVE-2025-25929 | OpenMRS 安全漏洞 | |
| CVE-2025-25925 | Openmrs 跨站脚本漏洞 | |
| CVE-2021-37787 | ABO.CMS 安全漏洞 | |
| CVE-2025-25748 | Hoteldruid 安全漏洞 | |
| CVE-2025-25749 | HotelDruid 安全漏洞 | |
| CVE-2025-25747 | Hoteldruid 跨站脚本漏洞 | |
| CVE-2025-25680 | LSC Smart Connect Indoor IP Camera 安全漏洞 |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Microweber
-
CVE-2026-67617
Microweber CMS 2.0.20 Stored XSS via tag_names Parameter -
CVE-2026-65693
Microweber CMS 2.0.20 Server-Side Template Injection via Mai -
CVE-2026-65694
Microweber CMS 2.0.20 Path Traversal via ServeStaticFileCont -
CVE-2026-12198
Microweber API Endpoint thumbnail_img userfiles_path path tr -
CVE-2024-58289
Microweber 2.0.15 Stored Cross-Site Scripting via User Profi
Same vendor: n/a
-
CVE-2026-105329
TallCMS PluginManager ThemeManager.php code injection -
CVE-2026-105315
django-haystack more_like_this Template Tag elasticsearch_ba -
CVE-2026-105307
Casdoor API Endpoint authz_filter.go ApiFilter missing authe -
CVE-2026-105263
Shaarli Admin Metadata Endpoint MetadataController.php Metad -
CVE-2026-105251
vgmstream VAG File psx_decoder.c ps_find_padding out-of-boun
Same weakness: CWE-79
-
CVE-2026-105397
LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Q -
CVE-2026-105291
feelec-yishu feelcrm-os Department Search Endpoint GroupCont -
CVE-2026-59788
Stored XSS vulnerability in OAuth configuration form -
CVE-2026-105289
feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFo -
CVE-2026-105288
feelec-yishu feelcrm-os Crm Endpoint functions.php index cro
V. Comments for CVE-2025-2214
No comments yet