CVE-2026-5695
Multiple vulnerabilities in the Microweber administration panel
- State
- Published
- Severity
- 8.4 High
- Published
- Sep 23, 2026
- Updated
- Sep 23, 2026
- Reserved
- Apr 6, 2026
Description
Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | INCIBE |
Weaknesses
- CWE-434 Unrestricted upload of file with dangerous type
Affected Products
| Product | Versions |
|---|---|
Administration panelMicroweber |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.