MaxSite CMS <=109.1 - Remote Code Execution

MaxSite CMS through 109.1 allows unauthenticated remote attackers to execute arbitrary code via the MarkItUp editor preview AJAX endpoint, preview-ajax.php. The endpoint insufficiently authenticates the request, failing to ensure the user is logged in, and processes the attacker's input via unsaf...

CVE-2026-70553-PoC

CVE-2026-70553 - MaxSite CMS 인증되지 않은 원격 코드 실행 RCE CVE-2026-70553에 대한 개념 증명PoC: 설치 엔드포인트를 통해 database.php에 지속적인 PHP 코드 주입을 수행하여 MaxSite CMS에서 인증되지 않은 원격 코드 실행RCE을 달성합니다. 면책 조항 이 PoC는 교육 및 승인된 보안 연구 목적으로만 제공됩니다. 작성자는 이 코드로 인한 오용이나 피해에 대해 책임을 지지 않습니다. 소유한 시스템 또는 명시적인 서면 승인을 받은 시스템에서만 테스트하십시오. 취약점 개요...

CVE-2026-3395-Lab

CVE-2026-3395 — MaxSite CMS 인증 없는 RCE 실습 환경 이 저장소는 교육 및 연구 목적으로만 제공됩니다. 모든 테스트는 로컬 Docker 실습 환경에서만 수행해야 합니다. 이 구성을 공개 또는 운영 환경에 배포하지 마십시오. 요약 CVE-2026-3395는 MaxSite CMS에 영향을 미치며 인증 없이 관리자 AJAX 엔드포인트에 접근할 수 있게 합니다. runphp 플러그인이 활성화되면 CMS 훅 시스템을 통해 사용자 입력이 PHP 코드로 평가될 수 있으며, 이로 인해 원격 코드 실행RCE이 발생할 ...

CVE-2026-3395-MaxSite-CMS-Unauthenticated-RCE

CVE‑2026‑3395 — MaxSite CMS 인증되지 않은 원격 코드 실행 개요 MaxSite CMS ≤ 109.1 에서 발견된 인증되지 않은 원격 코드 실행RCE 취약점입니다. 이 결함은 MarkItUp 편집기 플러그인의 AJAX 엔드포인트에서 약한 권한 검사와 runphp 플러그인이 사용자 제공 PHP 코드를 안전하지 않게 실행하는 것이 결합되어 발생합니다. 발견/수정: 2026년 3월 패치 버전: MaxSite CMS 109.2 공급업체: MaxSite CMS 저장소: maxsite/cms 설명 이 취약점은...

CVE-2026-87927

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

CVE-2026-87929

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87930

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-87930

MaxSite CMS through version 109.6 is affected by a PHP Object Injection vulnerability in the ci_session cookie handling. The Session library passes the cookie value to unserialize() without class restrictions, and a hardcoded encryption key allows unauthenticated attackers to forge valid session ...

CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

EUVD-2026-75111

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87929

MaxSite CMS through version 109.6 contains a hardcoded session encryption key in application/config/config.php that is never rotated during installation. Because the key is publicly known, an unauthenticated attacker can compute an HMAC-SHA1 signature to mint a malicious ci_session cookie with ad...

EUVD-2026-75112

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87928 MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a stored cross-site scripting vulnerability in the admin_page upload handler . Any logged-in user can upload HTML files to the uploads/_pages/ directory containing malicious scripts that execute in visitors' browsers when accessed, enabling persiste...

CVE-2026-87928 MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

EUVD-2026-75110

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...