High severity · published Oct 24, 2025
CVE-2025-60954
Microweber CMS 2.0 has Weak Password Requirements
8.3
CVSS
0.5%
EPSS
No
On KEV
Description
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Microweber · Microweber
2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-60954
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-60954
Exploit
https://gist.github.com/progprnv/feae2b76f2db0cb2ac6e14b1bf7d8646
Product
https://github.com/microweber/microweber
Exploit
https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-60954
More from Microweber
9.8
CVE-2023-1877
Command Injection in microweber/microweber
9.8
CVE-2022-2368
Authentication Bypass by Spoofing in microweber/microweber
9.8
CVE-2022-0895
Static Code Injection in microweber/microweber
9.8
CVE-2020-23138
An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page
8.8
CVE-2023-49052
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component