CVE-2026-5696
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Sep 23, 2026
Vendor
unknown
Description
Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.