Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-58289

Good to know:

icon

Date: December 11, 2025

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.

Severity Score

Related Resources (6)

https://microweber.me/
https://www.exploit-db.com/exploits/52058
https://github.com/microweber/microweber
https://www.vulncheck.com/advisories/microweber-stored-cross-site-scripting-via-user-profile-fields
https://nvd.nist.gov/vuln/detail/CVE-2024-58289
https://www.mend.io/vulnerability-database/CVE-2024-58289

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us