EUVD-2026-52909
GHSA-r998-r395-678g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access with trivial complexity (AV:N/AC:L/PR:N/UI:N); confirmed impact is integrity (poll/vote manipulation, I:H) while C and A are only conditionally reachable via other admin handlers, so C:L/A:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any *-ajax.php file in the codebase. Attackers can exploit this dispatcher bypass to reach privileged plugin endpoints without credentials, enabling actions such as manipulating poll states and vote counts, and amplifying the impact of any dangerous operation performed by admin-only ajax files across the plugin tree.
Articles & Coverage 1
AnalysisAI
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated AJAX endpoints by sending any X-Requested-With header alongside a base64-encoded path that resolves to any *-ajax.php file in the codebase. Because the dispatcher never verifies an admin session, attackers can invoke privileged plugin operations - demonstrated by manipulating poll states and vote counts - and can amplify any dangerous action exposed by admin-only AJAX files across the plugin tree. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a fixed release (109.6) is available.
Technical ContextAI
MaxSite CMS is a PHP-based content management system that routes asynchronous requests through a central AJAX dispatcher. The dispatcher gates access on the presence of an X-Requested-With header (the conventional marker of an XMLHttpRequest) and then loads a handler file whose path is supplied by the client as a base64-encoded value. The root cause is CWE-306 (Missing Authentication for a Critical Function): the dispatcher treats the mere presence of the X-Requested-With header as sufficient proof of a legitimate, authenticated admin context, when in fact any client can set that header to an arbitrary value. Combined with attacker-controlled path selection, this allows loading of any file matching the *-ajax.php naming convention - including handlers intended to run only for authenticated administrators. The affected CPE is cpe:2.3:a:maxsite:maxsite_cms:*:*:*:*:*:*:*:* across all versions up to and including 109.5.
RemediationAI
Upgrade to MaxSite CMS 109.6, which contains the vendor fix (Vendor-released patch: 109.6); see the release notes at https://max-3000.com/page/maxsite-cms-109-6 and the VulnCheck advisory at https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-ajax-dispatcher-bypass-via-ajax-php. If immediate patching is not possible, restrict network access to the CMS administration and AJAX endpoints (for example, IP-allowlist or place the admin surface behind a VPN/reverse proxy) so unauthenticated internet clients cannot reach the dispatcher; the trade-off is that legitimate remote admins must connect through the allowed path. As a stopgap, a WAF rule can block or challenge requests to *-ajax.php that carry base64-encoded path parameters or an X-Requested-With header from unauthenticated sessions, but tune carefully because MaxSite's own front-end legitimately sends X-Requested-With, so an overly broad rule may break site AJAX functionality. Do not rely on header inspection alone as a permanent control - the underlying flaw is that the header is trusted as authentication.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today