Vulnerability record/PUBLISHED/Published Jan 10, 2025 00:00:00 UTC

CVE-2024-33299

Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users

Base score4.7/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredHighPR

User interactionNoneUI

ScopeUnchangedS

Confidentiality impactLowC

Integrity impactLowI

Availability impactLowA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritymitre

Last updatedJan 14, 2025 16:07:19 UTC

PublishedJan 10, 2025 00:00:00 UTC

ReservedApr 23, 2024 00:00:00 UTC