43579 matches found
CVE-2026-7011 MaxSite CMS Antispam Plugin plugin_antispam cross site scripting
A weakness has been identified in MaxSite CMS up to 109.3. Affected by this vulnerability is an unknown functionality of the file /admin/pluginantispam of the component Antispam Plugin. Executing a manipulation of the argument floggingfile can lead to cross site scripting. It is possible to launc...
EUVD-2026-25685
A weakness has been identified in MaxSite CMS up to 109.3. Affected by this vulnerability is an unknown functionality of the file /admin/pluginantispam of the component Antispam Plugin. Executing a manipulation of the argument floggingfile can lead to cross site scripting. It is possible to launc...
CVE-2026-7011
MaxSite CMS
CVE-2026-7011 MaxSite CMS Antispam Plugin plugin_antispam cross site scripting
A weakness has been identified in MaxSite CMS up to 109.3. Affected by this vulnerability is an unknown functionality of the file /admin/pluginantispam of the component Antispam Plugin. Executing a manipulation of the argument floggingfile can lead to cross site scripting. It is possible to launc...
MaxSite CMS 跨站脚本漏洞
MaxSite CMS is an open-source website content management system developed by MaxSite in Russia. Versions of MaxSite CMS starting from 109.3 and earlier had a cross-site scripting vulnerability. This vulnerability stemmed from the handling of the ffile/fprefix parameters in the downcount Plugin...
MaxSite CMS 跨站脚本漏洞
MaxSite CMS is an open-source website content management system developed by MaxSite in Russia. Versions of MaxSite CMS starting from 109.3 and earlier had a cross-site scripting vulnerability. This vulnerability stemmed from operations with the ftext/fslug/flimit/femail parameters in the Guestbo...
GreenCMS 访问控制错误漏洞
GreenCMS is an open-source content management system CMS developed using ThinkPHP. Versions of GreenCMS 2.3 and earlier contained a security vulnerability related to access control. This vulnerability stemmed from improper handling of the pluginAddLocal function in the...
PT-2026-35178
Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.4 Description A weakness in the Antispam Plugin component, specifically within the '/admin/plugin antispam' file, allows for remote cross-site scripting XSS. This occurs due to a lack of filtering via the...
MaxSite CMS 跨站脚本漏洞
MaxSite CMS is an open-source website content management system developed by MaxSite in Russia. Versions of MaxSite CMS starting from 109.3 and earlier had a cross-site scripting vulnerability. This vulnerability stemmed from the floggingfile parameter in the admin/pluginantispam file within the...
PT-2026-35196
A vulnerability has been found in MaxSite CMS up to 109.3. This issue affects some unknown processing of the component Guestbook Plugin. Such manipulation of the argument f text/f slug/f limit/f email leads to cross site scripting. The attack may be launched remotely. The exploit has been disclos...
PT-2026-35195
A flaw has been found in MaxSite CMS up to 109.3. This vulnerability affects unknown code of the component down count Plugin. This manipulation of the argument f file/f prefix causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used...
MaxSite CMS 跨站脚本漏洞
MaxSite CMS is an open-source website content management system developed by MaxSite in Russia. Versions of MaxSite CMS prior to 109.3 contained a cross-site scripting vulnerability. This vulnerability stemmed from the operations involving parameters fsubject, ffiles, and ffrom in the mailsend...
PT-2026-35194
A security vulnerability has been detected in MaxSite CMS up to 109.3. Affected by this issue is some unknown functionality of the component mail send Plugin. The manipulation of the argument f subject/f files/f from leads to cross site scripting. The attack can be initiated remotely. The exploit...
PT-2026-35180
A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirect Plugin. The manipulation of the argument f all/f all404 results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to...
PT-2026-35198
A vulnerability was found in MaxSite CMS up to 109.3. Impacted is an unknown function of the component ushki Plugin. Performing a manipulation of the argument f ushka new/f ushk results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and...
Exploit for SQL Injection in Cmsmadesimple Cms_Made_Simple
-CVE-201...
Server-side Request Forgery (SSRF)
Overview pagekit/pagekit is a modular and lightweight CMS built with Symfony components and Vue.js. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the url argument in the /index.php/admin/system/update/download process. An attacker can access internal...
CVE-2026-6978 JiZhiCMS addcache.html htmlspecialchars_decode sql injection
A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialcharsdecode of the file /index.php/admins/Sys/addcache.html. The manipulation of the argument sqls results in sql injection. It is possible to launch the attack remotely. The exploit is now publi...
Server-Side Template Injection (SSTI)
getkirby/cms is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper enforcement of page status permissions during page creation through the REST API, which allows an attacker to create published pages directly and bypass the intended editorial workflow...
VulnCheck KEV: CVE-2026-29014
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve...