EUVD-2026-75110
GHSA-283m-m2f4-x73v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required CMS authentication; S:C and UI:R capture stored XSS scope change and necessary victim browser interaction; no availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.
AnalysisAI
Stored cross-site scripting in MaxSite CMS versions 0.94 through 109.6 stems from the admin_page plugin's upload handler accepting unrestricted HTML file uploads, placing attacker-controlled content in a publicly accessible web directory. Any authenticated low-privilege user can upload an HTML file containing malicious JavaScript to uploads/_pages/, where it executes in visitors' browsers upon access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid MaxSite CMS account at any privilege level that has access to the admin_page upload handler - the description specifies 'any logged-in user.' The attacker must be able to reach the CMS admin panel over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, score 5.1) reflects the principal mitigations: a valid CMS account (PR:L) is required, and a victim must navigate to the uploaded file (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is independently confirmed at time of analysis - administrators should verify the current upstream repository status at https://github.com/maxsite/cms for any fix commits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Maxsite Cms
View allA Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary
Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page. Rated critical severity (
Authentication bypass in MaxSite CMS versions 0.78 through 109.6 lets unauthenticated remote attackers forge valid admin
PHP object injection in MaxSite CMS through version 109.6 lets unauthenticated remote attackers forge valid ci_session c
Local file inclusion in MaxSite CMS through 109.6 allows unauthenticated remote attackers to execute privileged PHP hand
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-upd
A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attacke
Maxsite Cms versions up to 109.1. contains a vulnerability that allows attackers to code injection (CVSS 7.3).
Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the i
Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled seri
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated A
Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at
Share
External POC / Exploit Code
Leaving vuln.today