CVE-2026-70554: Deserialization of Untrusted Data

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...