Max 3000
Monthly
Maxsite Cms versions up to 109.1. contains a vulnerability that allows attackers to code injection (CVSS 7.3).
MaxSite CMS up to version 109 contains an improper access control vulnerability in the file editor plugin that allows authenticated remote attackers to upload arbitrary files by manipulating the file_path and content parameters in save-file-ajax.php. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to early disclosure attempts, leaving affected installations unpatched.
MaxSite CMS up to version 109 contains an unrestricted file upload vulnerability in the auto_post plugin's upload handler that allows authenticated remote attackers to bypass file upload restrictions by manipulating HTTP headers (X-Requested-FileName and X-Requested-FileUpDir). Public exploit code is available, though EPSS score (0.05%) suggests limited real-world exploitation despite the publicly disclosed proof-of-concept.
Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Maxsite Cms versions up to 109.1. contains a vulnerability that allows attackers to code injection (CVSS 7.3).
MaxSite CMS up to version 109 contains an improper access control vulnerability in the file editor plugin that allows authenticated remote attackers to upload arbitrary files by manipulating the file_path and content parameters in save-file-ajax.php. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to early disclosure attempts, leaving affected installations unpatched.
MaxSite CMS up to version 109 contains an unrestricted file upload vulnerability in the auto_post plugin's upload handler that allows authenticated remote attackers to bypass file upload restrictions by manipulating HTTP headers (X-Requested-FileName and X-Requested-FileUpDir). Public exploit code is available, though EPSS score (0.05%) suggests limited real-world exploitation despite the publicly disclosed proof-of-concept.
Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.