CVE-2026-70554

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

PT-2026-67848

Name of the Vulnerable Software and Affected Versions MaxSite CMS affected versions not specified Description An issue exists where unauthenticated attackers can execute arbitrary code by providing malicious serialized data through the maxsite comuser cookie. The application passes this data...