MEDIUM 5.9 NVD

CVE-2026-5696

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration pane

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-adm

Published: 2026-09-23 · Source: NVD · Feed updated: 2026-09-23

This medium severity vulnerability with a CVSS score of 5.9 was published on 2026-09-23 via NVD.

vulnfeed aggregates 12912 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.