EUVD-2026-25686Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
10DescriptionCVE.org
A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirect Plugin. The manipulation of the argument f_all/f_all404 results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 109.4 is able to mitigate this issue. The patch is identified as 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. You should upgrade the affected component. The vendor was informed early about this issue. They classify it as a "Self-XSS". They deployed a countermeasure: "Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via htmlspecialchars() has already been fixed in the latest patch to prevent incorrect data display."
AnalysisAI
Cross-site scripting vulnerability in MaxSite CMS Redirect Plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_all or f_all404 parameters due to missing output encoding with htmlspecialchars(). The vulnerability requires high-privilege authentication and user interaction to execute, resulting in low impact (integrity only); however, publicly available exploit code exists and the vendor has classified this as a self-XSS violation of secure coding standards. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) authentication as a user with high-privilege access (administrator or content manager role with Redirect Plugin permissions); (2) ability to submit input to the Redirect Plugin's f_all or f_all404 parameters; (3) user interaction (UI:R) - the victim must visit a page displaying or processing the malicious parameter output; (4) the Redirect Plugin component must be installed and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite a low CVSS score of 2.4, this vulnerability carries nuanced risk factors that require careful interpretation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An administrator or high-privilege content manager with access to the Redirect Plugin configuration submits a crafted request containing malicious JavaScript in the f_all or f_all404 parameter (e.g., f_all=%3Cscript%3Ealert('XSS')%3C%2Fscript%3E). If another user (who must interact with the page, per UI:R) visits the plugin's configuration page or a page displaying redirect data, the unencoded payload executes in their browser. … |
| Remediation | Upgrade MaxSite CMS to version 109.4 or later, which includes the htmlspecialchars() filtering fix (commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today