Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('system') into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-65693 Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command executi… https://www.cve.org/CVERecord?id=CVE-2026-65693
Post summary
The text announces the CVE-2026-65693 vulnerability in Microweber CMS, detailing a server‑side template injection that lets authenticated admins run arbitrary OS commands.
CVE-2026-65693 Server-Side Template Injection in Microweber CMS Through 2.0.20 Enables Arbitrary Command Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-65693
Post summary
CVE-2026-65693 is a Server‑Side Template Injection flaw in Microweber CMS 2.0.20 that allows arbitrary command execution, as reported in a vulnerability database entry.