EUVD Vulnerability Catalog
EUVD-2026-85220
Severity: MEDIUM
Base Score: 5.9
CVSS Version: 4.0
Vulnerability Description
Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): High
▪
User Interaction (UI): Active
▪
Vulnerability Confidentiality Impact (VC): None
▪
Vulnerability Integrity Impact (VI): None
▪
Vulnerability Availability Impact (VA): None
▪
Subsequent Confidentiality Impact (SC): High
▪
Subsequent Integrity Impact (SI): None
▪
Subsequent Availability Impact (SA): None
Affected Vendors & Systems
Vendor
microweber
References & Advisory Links
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
INCIBE
EPSS Probability
0.31
Known Aliases
GHSA-vvj3-3h3h-g964
CVE-2026-5696
Published On
2026-09-23
Last Updated
2026-09-23