Maxsite
Monthly
PHP object injection in MaxSite CMS through version 109.6 lets unauthenticated remote attackers forge valid ci_session cookies and pass attacker-controlled serialized data to an unrestricted unserialize() call. Because the framework ships a hardcoded encryption key, an attacker can sign forged session cookies that pass integrity checks, instantiate arbitrary PHP objects, and trigger magic methods to corrupt application state or achieve remote code execution when suitable gadget classes are present. Publicly available exploit code exists (reported by VulnCheck); this is a deserialization flaw (CWE-502) with a full-impact CVSS 4.0 score of 9.2.
Authentication bypass in MaxSite CMS versions 0.78 through 109.6 lets unauthenticated remote attackers forge valid administrator session cookies because the framework ships with a hardcoded session encryption key in application/config/config.php that installers never rotate. Using the publicly known key, an attacker computes a valid HMAC-SHA1 over a crafted ci_session cookie to impersonate an admin, defeating the is_login() and mso_check_allow() authorization checks. Publicly available exploit code exists (published by VulnCheck / EviL0rd); there is no evidence of active exploitation in CISA KEV at time of analysis.
Local file inclusion in MaxSite CMS through 109.6 allows unauthenticated remote attackers to execute privileged PHP handler files by supplying base64-encoded path traversal sequences to the ajax and require-maxsite dispatcher endpoints. The encoding technique bypasses the dispatchers' path validation logic, enabling attackers to reach admin-gated handler actions entirely without credentials. A public proof-of-concept exploit was published on 2026-09-08; the vulnerability spans essentially the entire version history of the product (0.78 through 109.6), and no patched release has been confirmed at time of analysis.
Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.
Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated AJAX endpoints by sending any X-Requested-With header alongside a base64-encoded path that resolves to any *-ajax.php file in the codebase. Because the dispatcher never verifies an admin session, attackers can invoke privileged plugin operations - demonstrated by manipulating poll states and vote counts - and can amplify any dangerous action exposed by admin-only AJAX files across the plugin tree. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a fixed release (109.6) is available.
Stored cross-site scripting in MaxSite CMS versions 0.94 through 109.6 stems from the admin_page plugin's upload handler accepting unrestricted HTML file uploads, placing attacker-controlled content in a publicly accessible web directory. Any authenticated low-privilege user can upload an HTML file containing malicious JavaScript to uploads/_pages/, where it executes in visitors' browsers upon access. A publicly available proof-of-concept exploit exists; active exploitation has not been confirmed in CISA KEV, but the persistent execution path and low-privilege requirement make this a realistic risk for multi-author deployments.
Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the ushki Plugin's f_ushka_new or f_ushk parameters. The vulnerability requires user interaction to trigger, but publicly available exploit code exists. Vendor classified this as self-XSS and fixed the root cause (missing htmlspecialchars() filtering) in version 109.4.
Cross-site scripting (XSS) in MaxSite CMS Guestbook Plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_text, f_slug, f_limit, or f_email parameters due to missing htmlspecialchars() output filtering. The vulnerability requires high-privilege authentication and user interaction (UI:P), limiting it to trusted administrators, but publicly available exploit code exists. Upgrading to version 109.4 resolves the issue by implementing proper output encoding.
Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 affects the down_count plugin, where unsanitized input in the f_file and f_prefix parameters allows authenticated high-privilege users to inject malicious scripts via remote network access with user interaction. The vendor classifies this as self-XSS due to high privilege requirements (PR:H) and user interaction (UI:P), but the lack of output encoding via htmlspecialchars() represents a secure coding violation. Publicly available exploit code exists, and a patch is available in version 109.4.
Cross-site scripting (XSS) in MaxSite CMS mail_send plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_subject, f_files, or f_from parameters, resulting in stored XSS that can affect other users. The vulnerability stems from missing input sanitization via htmlspecialchars() and is classified by the vendor as self-XSS. Publicly available exploit code exists, and a patch is available in version 109.4.
Cross-site scripting vulnerability in MaxSite CMS Redirect Plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_all or f_all404 parameters due to missing output encoding with htmlspecialchars(). The vulnerability requires high-privilege authentication and user interaction to execute, resulting in low impact (integrity only); however, publicly available exploit code exists and the vendor has classified this as a self-XSS violation of secure coding standards. Upgrade to version 109.4 or later to remediate.
Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 allows authenticated administrators to inject malicious scripts via the f_logging_file parameter in the Antispam Plugin admin interface, leading to stored XSS with user interaction required. The vulnerability affects the /admin/plugin_antispam endpoint and results from insufficient output encoding. Vendor-released patch version 109.4 addresses the issue by implementing htmlspecialchars() filtering; publicly available exploit code exists.
Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PHP object injection in MaxSite CMS through version 109.6 lets unauthenticated remote attackers forge valid ci_session cookies and pass attacker-controlled serialized data to an unrestricted unserialize() call. Because the framework ships a hardcoded encryption key, an attacker can sign forged session cookies that pass integrity checks, instantiate arbitrary PHP objects, and trigger magic methods to corrupt application state or achieve remote code execution when suitable gadget classes are present. Publicly available exploit code exists (reported by VulnCheck); this is a deserialization flaw (CWE-502) with a full-impact CVSS 4.0 score of 9.2.
Authentication bypass in MaxSite CMS versions 0.78 through 109.6 lets unauthenticated remote attackers forge valid administrator session cookies because the framework ships with a hardcoded session encryption key in application/config/config.php that installers never rotate. Using the publicly known key, an attacker computes a valid HMAC-SHA1 over a crafted ci_session cookie to impersonate an admin, defeating the is_login() and mso_check_allow() authorization checks. Publicly available exploit code exists (published by VulnCheck / EviL0rd); there is no evidence of active exploitation in CISA KEV at time of analysis.
Local file inclusion in MaxSite CMS through 109.6 allows unauthenticated remote attackers to execute privileged PHP handler files by supplying base64-encoded path traversal sequences to the ajax and require-maxsite dispatcher endpoints. The encoding technique bypasses the dispatchers' path validation logic, enabling attackers to reach admin-gated handler actions entirely without credentials. A public proof-of-concept exploit was published on 2026-09-08; the vulnerability spans essentially the entire version history of the product (0.78 through 109.6), and no patched release has been confirmed at time of analysis.
Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.
Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated AJAX endpoints by sending any X-Requested-With header alongside a base64-encoded path that resolves to any *-ajax.php file in the codebase. Because the dispatcher never verifies an admin session, attackers can invoke privileged plugin operations - demonstrated by manipulating poll states and vote counts - and can amplify any dangerous action exposed by admin-only AJAX files across the plugin tree. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a fixed release (109.6) is available.
Stored cross-site scripting in MaxSite CMS versions 0.94 through 109.6 stems from the admin_page plugin's upload handler accepting unrestricted HTML file uploads, placing attacker-controlled content in a publicly accessible web directory. Any authenticated low-privilege user can upload an HTML file containing malicious JavaScript to uploads/_pages/, where it executes in visitors' browsers upon access. A publicly available proof-of-concept exploit exists; active exploitation has not been confirmed in CISA KEV, but the persistent execution path and low-privilege requirement make this a realistic risk for multi-author deployments.
Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the ushki Plugin's f_ushka_new or f_ushk parameters. The vulnerability requires user interaction to trigger, but publicly available exploit code exists. Vendor classified this as self-XSS and fixed the root cause (missing htmlspecialchars() filtering) in version 109.4.
Cross-site scripting (XSS) in MaxSite CMS Guestbook Plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_text, f_slug, f_limit, or f_email parameters due to missing htmlspecialchars() output filtering. The vulnerability requires high-privilege authentication and user interaction (UI:P), limiting it to trusted administrators, but publicly available exploit code exists. Upgrading to version 109.4 resolves the issue by implementing proper output encoding.
Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 affects the down_count plugin, where unsanitized input in the f_file and f_prefix parameters allows authenticated high-privilege users to inject malicious scripts via remote network access with user interaction. The vendor classifies this as self-XSS due to high privilege requirements (PR:H) and user interaction (UI:P), but the lack of output encoding via htmlspecialchars() represents a secure coding violation. Publicly available exploit code exists, and a patch is available in version 109.4.
Cross-site scripting (XSS) in MaxSite CMS mail_send plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_subject, f_files, or f_from parameters, resulting in stored XSS that can affect other users. The vulnerability stems from missing input sanitization via htmlspecialchars() and is classified by the vendor as self-XSS. Publicly available exploit code exists, and a patch is available in version 109.4.
Cross-site scripting vulnerability in MaxSite CMS Redirect Plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_all or f_all404 parameters due to missing output encoding with htmlspecialchars(). The vulnerability requires high-privilege authentication and user interaction to execute, resulting in low impact (integrity only); however, publicly available exploit code exists and the vendor has classified this as a self-XSS violation of secure coding standards. Upgrade to version 109.4 or later to remediate.
Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 allows authenticated administrators to inject malicious scripts via the f_logging_file parameter in the Antispam Plugin admin interface, leading to stored XSS with user interaction required. The vulnerability affects the /admin/plugin_antispam endpoint and results from insufficient output encoding. Vendor-released patch version 109.4 addresses the issue by implementing htmlspecialchars() filtering; publicly available exploit code exists.
Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.