CVE-2025-60954: Microweber

High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts.

Affected products

• Microweber Microweber: version 2.0.0 only

Published 2025-10-24. Last modified 2026-06-17.