What is GHSA-vvj3-3h3h-g964?

GHSA-vvj3-3h3h-g964 is a security advisory published by GitHub Security Advisories with Medium severity. Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’...

Which CVE IDs does GHSA-vvj3-3h3h-g964 cover?

GHSA-vvj3-3h3h-g964 covers the following CVE IDs: CVE-2026-5696. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-vvj3-3h3h-g964Medium

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’...

Vendor

GitHub Security Advisories

Published

September 23, 2026

Last Modified

September 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-5696 →

📋 Description

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-5696
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel
https://github.com/advisories/GHSA-vvj3-3h3h-g964