Microweber EUVD-2026-85220

Exploitation requires the victim to be an authenticated administrator with access to the Microweber administration panel (PR:H), and requires active user interaction (UI:A) - the admin must open an attacker-crafted URL that injects a payload into the 'group' parameter of the '/admin/settings' endpoint. The reflected nature means the payload lives in the request, so delivery is via phishing/social engineering to a known privileged user rather than a stored/persistent vector. Limiting factors: only administrators are viable targets, the link must be clicked, and there is no impact to the server itself - impact is confined to the victim's browser session (SC:H).

This is a moderate, low-priority issue whose severity is heavily constrained by its own prerequisites. The vendor CVSS 4.0 vector (5.9, AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N) tells a self-limiting story: exploitation requires HIGH privileges (PR:H - the victim must already be an authenticated administrator) AND active user interaction (UI:A - the admin must click a crafted link). The vulnerable server itself suffers no impact (VC:N/VI:N/VA:N); the only meaningful impact is SC:H, modeling script execution in the victim admin's browser (session theft, actions-on-behalf). There is NO EPSS score, NO CISA KEV listing, and NO public POC referenced - the sole source is an INCIBE-CERT advisory. Exploitation status: no public exploit identified at time of analysis. Because the attacker must trick a user who is ALREADY an authenticated admin, the practical attack surface is narrow (essentially a targeted social-engineering / phishing chain against a known admin), which is far below what the 5.9 network-vector number might superficially suggest. No signals conflict, but note the paradox typical of admin-panel XSS: PR:H means the victim is privileged, yet the attacker themselves needs no credentials - they only need to lure the privileged victim.

An attacker crafts a malicious URL targeting the '/admin/settings' endpoint with a JavaScript payload in the 'group' parameter and phishes it to a logged-in Microweber administrator. When the admin opens the link, the reflected payload executes in their authenticated session context, letting the attacker steal the session/cookies or perform admin actions on their behalf. No public POC is referenced; the attack requires the victim to be an authenticated admin and to click the link (UI:A).