Threats affecting pkg:composer/microweber/microweber

CVE-2026-5696 is a reflected cross-site scripting (XSS) vulnerability in the Microweber administration panel. It affects the 'group' parameter of the '/admin/settings' endpoint. An attacker can exploit this flaw by tricking an authenticated user into executing malicious JavaScript code in their browser. This can lead to unauthorized actions, theft of confidential information, or session hijacking. The vulnerability is rated medium severity with a CVSS score of 5.9. The affected version is exactly 2.0.19. No patch or remediation information is currently provided.

CVE-2026-5695 is an arbitrary file upload vulnerability in the Microweber Administration panel version 2.0.19. It arises from insufficient validation in upload forms, allowing authenticated users to upload files without restriction. This flaw can be exploited to execute malicious code remotely, potentially leading to full system compromise. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.4. No patch or official remediation information is provided in the available data.