CVE-2026-5696

MediumCVSS 5.9/10Last modified Sep 24, 2026

Description

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.

Metrics

CVSS 4.0 5.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-569609.8In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote escalation of privileg CVE-2026-569646.4In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with Sys CVE-2026-569668.4In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappings to secure memory CVE-2026-569678.0In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code CVE-2026-569685.3GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory di CVE-2026-56969In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code. This could lead to CVE-2026-56974.8Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user CVE-2026-569708.4In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privi CVE-2026-56971In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to CVE-2026-569726.7In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of priv CVE-2026-569736.7In multiple locations, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of CVE-2026-569748.8In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation. This could lead to rem