EUVD Vulnerability Catalog

EUVD-2026-85219

Severity: HIGH Base Score: 8.4 CVSS Version: 4.0

Vulnerability Description

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): High

▪ User Interaction (UI): Active

▪ Vulnerability Confidentiality Impact (VC): High

▪ Vulnerability Integrity Impact (VI): High

▪ Vulnerability Availability Impact (VA): High

▪ Subsequent Confidentiality Impact (SC): None

▪ Subsequent Integrity Impact (SI): None

▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor microweber

References & Advisory Links

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

INCIBE

EPSS Probability

0.3

Known Aliases

GHSA-vmxq-r7p4-j4f6 CVE-2026-5695

Published On

2026-09-23

Last Updated

2026-09-23