TI-2023-25635 Aliases CVE-2023-47379 GHSA-jmwm-w2rm-prv9

Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the…

LOW 25CWE-79Published 2023-11-08 · Updated 2024-09-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0051 43rd percentileScored 2026-11-07

Fix Fixed microweber/microweber (Packagist): 2.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	microweber/microweber (Packagist)	before 2.0.3	2.0.3	Patch available	GHSA-jmwm-w2rm-prv9

— Vendor— Affected all versions Fixed in — No fix listed CNA
microweber/microweber (Packagist) Vendor— Affected before 2.0.3 Fixed in 2.0.3 Patch available GHSA-jmwm-w2rm-prv9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:microweber:microweber:2.0.1:::::::*	2.0.1	Vulnerable	microweber

cpe:2.3:a:microweber:microweber:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·microweber

Remediation

Fix · GHSA-jmwm-w2rm-prv9 microweber/microweber (Packagist) Fixed in 2.0.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-47379
2026-10-03 Alias added: GHSA-jmwm-w2rm-prv9

References

Patch 1

https://github.com/microweber/microweber/commit/c6e7ea9d0abd7564a3bb23c14ad172e4ccf27a7e#diff-fac4e7e9eca69c10d074bf8c5eac7f64b018c6b4d91dcad54b340a8560049e00

Advisory 2

Other 4

TI-2023-01763 Command Injection in microweber/microweber CVSS 3.1CRITICAL 9.8
TI-2023-02100 Improper Privilege Management in microweber/microweber CVSS 3.1HIGH 8.8
TI-2022-14518 Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. CVSS 3.1HIGH 8.8
TI-2023-04891 Use of Hard-coded Credentials in microweber/microweber CVSS 3.1HIGH 7.5
TI-2025-37870 Microweber CMS 2.0 has Weak Password Requirements. CVSS 3.1HIGH 8.3
TI-2022-04247 Cross-site Scripting (XSS) - Stored in microweber/microweber CVSS 3.1MEDIUM 6.1

See all 113 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences