CVE-2026-5696 — Multiple vulnerabilities in the Microweber administration panel

CVE-2026-5696

Multiple vulnerabilities in the Microweber administration panel PUBLISHED

Description (CNA)

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.

Affected (CNA)

Vendor / product	Versions
Microweber / Administration panel	affected 2.0.19

CWE

CWE-79

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.