CVE-2026-87930

MaxSite CMS through version 109.6 is affected by a PHP Object Injection vulnerability in the ci_session cookie handling. The Session library passes the cookie value to unserialize() without class restrictions, and a hardcoded encryption key allows unauthenticated attackers to forge valid session ...

CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...