CVE-2026-5696
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the 'group' parameter of the '/admin/settings' endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser.
Risk Assessment
An attacker can perform actions without the victim's consent, steal confidential information, or hijack the user's session, potentially leading to account and data compromise.
Recommendation
Update Microweber to the latest version containing the XSS fix and consider input validation and sanitization.
Other vulnerabilities in Microweber
See all- CVE-2026-12198High
In Microweber up to 2.0.20, a path traversal vulnerability exists in the userfiles_path function of /api_nosession/thumbnail_img via manipulation of the cache_path_relative argument. The attack can be launched remotely and the exploit is publicly available.
- CVE-2024-40101Medium
A reflected XSS vulnerability exists in Microweber 2.0.15 and earlier in the '/search' endpoint. An unauthenticated remote attacker can inject arbitrary web script or HTML via the 'keywords' parameter.
- CVE-2020-23136Medium
A vulnerability in Microweber v1.1.18 causes the user session not to expire after logout. This allows an attacker to reuse a valid session for unauthorized access.
Original NVD description (English source)
Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS