CNNVD-202602-811 Information
CNNVD ID
CNNVD-202602-811
Related CVE
- CNNVD Published: 2026-02-05
Description (Chinese)
Microweber是Microweber开源的一套可提供拖拽功能的网上商店管理系统。该系统包括添加商品、图片等模块。 Microweber 2.0.19版本存在安全漏洞，该漏洞源于/admin/category/create端点存在跨站脚本，攻击者可操纵rel_id参数并诱骗具有管理员权限的用户访问，从而在受害者浏览器中执行JavaScript代码。
Description (English)
Microweber is an open source of Microroweber ’ s web-based store management system, which provides drag and drag functions. The system includes modules such as additions to commodities, pictures, etc. Version 2.0.19 contains a security loophole that originates from the existence of a cross-site script at the /admin/category/create end, where the assailant can manipulate rel id parameters and lure users with administrator privileges to access, thereby implementing the JavaScript code in the victim browser.
Hazard Level
High
Vulnerability Type
其他
Affected Vendor
Microweber
Published
2026-02-05
Last Modified
2026-02-24
References
https://gist.github.com/TimRecktenwald/f4b0d1edbb87e75c17c639ca0bacba57 https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f
Patch
https://microweber.org/download
Share on: