CVE-2025-60954

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-60954
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts.

8.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://gist.github.com/progprnv/feae2b76f2db0cb2ac6e14b1bf7d8646 Exploit Third Party Advisory
https://github.com/microweber/microweber Product
https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-60954 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:microweber:microweber:2.0.0:*:*:*:*:*:*:*
History

28 Oct 2025, 14:22

Type Values Removed Values Added
CPE cpe:2.3:a:microweber:microweber:2.0.0:*:*:*:*:*:*:*
First Time Microweber microweber
Microweber
References () https://gist.github.com/progprnv/feae2b76f2db0cb2ac6e14b1bf7d8646 - () https://gist.github.com/progprnv/feae2b76f2db0cb2ac6e14b1bf7d8646 - Exploit, Third Party Advisory
References () https://github.com/microweber/microweber - () https://github.com/microweber/microweber - Product
References () https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-60954 - () https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-60954 - Exploit, Third Party Advisory

24 Oct 2025, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-24 21:16

Updated : 2025-10-28 14:22

NVD link : CVE-2025-60954

Mitre link : CVE-2025-60954

CVE.ORG link : CVE-2025-60954

JSON object : View

Products Affected

microweber

  • microweber
CWE
CWE-521

Weak Password Requirements