CVE-2026-3395

A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editormarkitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack...

CVE-2026-3395

Summary (CVE-2026-3395): MaxSite CMS up to 109.1 contains a flaw in the MarkItUp Preview AJAX Endpoint (preview-ajax.php) where unsanitized input is passed to run_php and evaluated via PHP eval(), enabling unauthenticated remote code execution. This is driven by weak authorization checks in the M...