Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by INCIBE

CVE-2026-5695Multiple vulnerabilities in the Microweber administration panel

High 8.4

In plain English

A high-severity unrestricted file upload in Administration panel from Microweber. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High
Exploit odds (30 days)0.4%top 64.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.

Affected products (as reported)

VendorProductVersions
Microweber Administration panel 2.0.19

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References