CNNVD-202602-812 Information
CNNVD ID
CNNVD-202602-812
Related CVE
- CNNVD Published: 2026-02-05
Description (Chinese)
Microweber是Microweber开源的一套可提供拖拽功能的网上商店管理系统。该系统包括添加商品、图片等模块。 Microweber 2.0.19版本存在安全漏洞，该漏洞源于/admin/order/abandoned端点存在跨站脚本，攻击者可操纵orderDirection参数并诱骗具有管理员权限的用户访问，从而在受害者浏览器中执行JavaScript代码。
Description (English)
Microweber is an open source of Microroweber ’ s web-based store management system, which provides drag and drag functions. The system includes modules such as additions to commodities, pictures, etc. Micrower 2.0.19 has a security loophole, which stems from the existence of a cross-site script at the /admin/order/abandoned endpoint, where the assailant can manipulate orderDiraction parameters and lure users with administrator access, thereby implementing the JavaScript code in the victim browser.
Hazard Level
High
Vulnerability Type
其他
Affected Vendor
Microweber
Published
2026-02-05
Last Modified
2026-02-24
References
https://gist.github.com/TimRecktenwald/9615b9915a4cacda9f57bb57f13ab6d4 https://github.com/microweber/microweber/commit/aa0791fc286d785ccd33ccc706f7bb3ed05b1d7f
Patch
https://microweber.org/download
Share on: