CVE-2025-51503:
PHP vulnerability analysis and mitigation

Overview

A Stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-51503) was discovered in Microweber CMS version 2.0. The vulnerability allows attackers to inject malicious scripts into user profile fields, which can then be executed when viewed by admin browsers. This vulnerability was disclosed on July 31, 2025 (NVD).

Technical details

The vulnerability has been assigned a CVSS v3.1 base score of 7.6 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The issue stems from insufficient input validation in the user profile fields of the admin panel (NVD).

Impact

When successfully exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the context of admin users' browsers. This could lead to unauthorized access to sensitive information, potential account takeover, and compromise of admin-level functionality (NVD).

Mitigation and workarounds

The vulnerability affects Microweber CMS version 2.0. Users are advised to update to the latest version once a patch is available. In the meantime, administrators should implement strict input validation and sanitization for user profile fields (NVD).