CVE-2024-58289

Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields

Medium5.3Public exploitEPSS 0.26%

Published: 11 Dec 2025
Updated: 7 Apr 2026
Reserved: 10 Dec 2025
Assigned by: VulnCheck

Description

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-52058 (opens in a new tab)exploit

Timeline

2025
10 Dec 2025
10 Dec 2025
ID reserved
By VulnCheck
11 Dec 20251 day later
11 Dec 2025· 1 day later
Published
2026
7 Apr 20264 months later
7 Apr 2026· 4 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-58289, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
NVDNVD · Analyzed	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.26% · top 82% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

microweber · Microweber
- affected 2.0.15

References (4)

ExploitDB-52058 (opens in a new tab)exploit
Microweber Homepage (opens in a new tab)product
Microweber GitHub Repository (opens in a new tab)product
VulnCheck Advisory: Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2024-58289](https://trackcve.app/badge/CVE-2024-58289.svg)](https://trackcve.app/cve/CVE-2024-58289)

Record last updated 7 Apr 2026, 14:08 UTC.