{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.0.19"}],"component":"microweber/microweber","cve_ids":["CVE-2025-2214"],"ecosystem":"Packagist","epss":0.0052,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-hcgh-r5gq-6qc2","id":"tcs_01M5KF3JRK8YR9MKKKT4W1SMHC","modified_at":"2025-07-09T19:12:16.389240Z","published_at":"2025-03-12T00:31:50Z","references":["https://osv.dev/vulnerability/GHSA-hcgh-r5gq-6qc2","https://nvd.nist.gov/vuln/detail/CVE-2025-2214","https://github.com/Fewword/Poc/blob/main/microweber/mwb-poc1.md","https://github.com/microweber/microweber","https://vuldb.com/?ctiid.299285","https://vuldb.com/?id.299285","https://vuldb.com/?submit.512032"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-hcgh-r5gq-6qc2","url":"https://osv.dev/vulnerability/GHSA-hcgh-r5gq-6qc2"}],"summary":"Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler"}