CVE-2025-60954

8.3 highEPSS 0.5%

High (8.3) in microweber microweber. EPSS 0.5% chance of exploitation in the next 30 days.

Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts.

Severity

CVSS 3.1

8.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-521
Published: 2025-10-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

microweber:microweber

References

https://gist.github.com/progprnv/feae2b76f2db0cb2ac6e14b1bf7d8646
https://github.com/microweber/microweber
https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-60954

Check your stack JSON