Microweber CMS 2.0 contains a stored Cross Site Scripting vulnerability that could allow an authenticated attacker to execute malicious scripts in the context of other users.

This is a stored Cross Site Scripting (XSS) vulnerability occurring at the /projects/profile homepage endpoint. The flaw is triggered by injecting malicious scripts into the last name field, which requires the attacker to have low-level authenticated access to the application.

The exploitation of this vulnerability allows an attacker to inject arbitrary JavaScript that executes within the browser sessions of other authenticated users, including administrators. This can lead to unauthorized actions performed on behalf of victims, session hijacking, or the theft of sensitive session tokens. Given the CVSS score of 7.6, this vulnerability poses a significant risk to the integrity and confidentiality of the application environment.

Immediate Action: As no official patch is currently listed for this version, administrators should restrict access to profile management features and implement strict input validation for the affected field.

Proactive Monitoring: Monitor application logs for suspicious activity within the projects profile section and audit user profile updates for anomalous script-like characters in name fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads, particularly those containing script tags or event handlers, to mitigate potential exploitation attempts.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the security researcher's report on GitHub.

Security teams should prioritize the identification of all exposed instances of Microweber CMS 2.0 and apply necessary input sanitization filters to the last name field immediately. Because this vulnerability is currently unpatched, maintain heightened vigilance regarding user behavior and verify that all administrative accounts are protected by strong authentication mechanisms to prevent potential lateral movement if a session is compromised.