CVE-2024-40101

MediumCVSS 6.1

Published: 06/08/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.85%

54th percentile - higher than 54% of all known CVEs

Summary

A reflected XSS vulnerability exists in Microweber 2.0.15 and earlier in the '/search' endpoint. An unauthenticated remote attacker can inject arbitrary web script or HTML via the 'keywords' parameter.

Risk Assessment

An attacker can steal user session data, redirect the victim to a malicious site, or perform other harmful actions within the victim's browser context.

Recommendation

Immediately update Microweber to version 2.0.16 or later and implement input validation and encoding for the 'keywords' parameter.

Original NVD description (English source)

A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.