MaxSite CMS <=109.1 - Remote Code Execution

MaxSite CMS through 109.1 allows unauthenticated remote attackers to execute arbitrary code via the MarkItUp editor preview AJAX endpoint, preview-ajax.php. The endpoint insufficiently authenticates the request, failing to ensure the user is logged in, and processes the attacker's input via unsaf...

CVE-2026-70553-PoC

CVE-2026-70553 - MaxSite CMS 未认证远程代码执行漏洞 CVE-2026-70553 概念验证：通过安装端点向 database.php 持久化注入 PHP 代码，实现未认证远程代码执行。 免责声明 本 PoC 仅用于教育和授权安全研究目的 。作者不对因使用此代码造成的任何滥用或损害负责。仅对您拥有或已获得明确书面授权的系统进行测试。 漏洞概述 MaxSite CMS 105.2 至 109.5 版本的安装端点存在严重的未认证远程代码执行漏洞。dbdbprefix 参数在未经过滤的情况下直接拼接到 PHP 代码中，攻击者可以向...

CVE-2026-3395-Lab

CVE-2026-3395 — MaxSite CMS 未认证 RCE 实验环境 本仓库仅用于教育和研究目的。 所有测试必须在本地 Docker 实验环境中进行。 请勿将此配置部署到公共或生产系统。 概述 CVE-2026-3395 影响 MaxSite CMS，允许未认证访问管理 AJAX 端点。当启用 runphp 插件时，用户输入可通过 CMS 钩子系统被作为 PHP 代码执行，这可能导致远程代码执行（RCE）。 本仓库包含： 易受攻击的构建（补丁前提交） 已修补的构建（修复后提交） 用于复现的 Docker 实验环境 安全的影响证明演示 漏洞概述 易受攻击的端点位于：...

CVE-2026-3395-MaxSite-CMS-Unauthenticated-RCE

CVE‑2026‑3395 — MaxSite CMS 未认证远程代码执行 概述 MaxSite CMS ≤ 109.1 中存在未认证远程代码执行（RCE）漏洞。 该缺陷源于 MarkItUp 编辑器插件 AJAX 端点中薄弱的授权检查，以及 runphp 插件对用户提供的 PHP 代码的不安全执行。 发现/修复时间： 2026 年 3 月 修复版本： MaxSite CMS 109.2 厂商： MaxSite CMS 仓库： maxsite/cms 描述 该漏洞影响 MarkItUp 编辑器插件中的以下文件： preview-ajax.php autosave-post-ajax.ph...

CVE-2026-87927

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

CVE-2026-87929

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

CVE-2026-87930

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87930

MaxSite CMS through version 109.6 is affected by a PHP Object Injection vulnerability in the ci_session cookie handling. The Session library passes the cookie value to unserialize() without class restrictions, and a hardcoded encryption key allows unauthenticated attackers to forge valid session ...

EUVD-2026-75111

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-87929

MaxSite CMS through version 109.6 contains a hardcoded session encryption key in application/config/config.php that is never rotated during installation. Because the key is publicly known, an unauthenticated attacker can compute an HMAC-SHA1 signature to mint a malicious ci_session cookie with ad...

EUVD-2026-75112

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a stored cross-site scripting vulnerability in the admin_page upload handler . Any logged-in user can upload HTML files to the uploads/_pages/ directory containing malicious scripts that execute in visitors' browsers when accessed, enabling persiste...

CVE-2026-87928 MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

EUVD-2026-75110

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

CVE-2026-87928 MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...