Maxsite Cms
Monthly
PHP object injection in MaxSite CMS through version 109.6 lets unauthenticated remote attackers forge valid ci_session cookies and pass attacker-controlled serialized data to an unrestricted unserialize() call. Because the framework ships a hardcoded encryption key, an attacker can sign forged session cookies that pass integrity checks, instantiate arbitrary PHP objects, and trigger magic methods to corrupt application state or achieve remote code execution when suitable gadget classes are present. Publicly available exploit code exists (reported by VulnCheck); this is a deserialization flaw (CWE-502) with a full-impact CVSS 4.0 score of 9.2.
Authentication bypass in MaxSite CMS versions 0.78 through 109.6 lets unauthenticated remote attackers forge valid administrator session cookies because the framework ships with a hardcoded session encryption key in application/config/config.php that installers never rotate. Using the publicly known key, an attacker computes a valid HMAC-SHA1 over a crafted ci_session cookie to impersonate an admin, defeating the is_login() and mso_check_allow() authorization checks. Publicly available exploit code exists (published by VulnCheck / EviL0rd); there is no evidence of active exploitation in CISA KEV at time of analysis.
Local file inclusion in MaxSite CMS through 109.6 allows unauthenticated remote attackers to execute privileged PHP handler files by supplying base64-encoded path traversal sequences to the ajax and require-maxsite dispatcher endpoints. The encoding technique bypasses the dispatchers' path validation logic, enabling attackers to reach admin-gated handler actions entirely without credentials. A public proof-of-concept exploit was published on 2026-09-08; the vulnerability spans essentially the entire version history of the product (0.78 through 109.6), and no patched release has been confirmed at time of analysis.
Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.
Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated AJAX endpoints by sending any X-Requested-With header alongside a base64-encoded path that resolves to any *-ajax.php file in the codebase. Because the dispatcher never verifies an admin session, attackers can invoke privileged plugin operations - demonstrated by manipulating poll states and vote counts - and can amplify any dangerous action exposed by admin-only AJAX files across the plugin tree. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a fixed release (109.6) is available.
Stored cross-site scripting in MaxSite CMS versions 0.94 through 109.6 stems from the admin_page plugin's upload handler accepting unrestricted HTML file uploads, placing attacker-controlled content in a publicly accessible web directory. Any authenticated low-privilege user can upload an HTML file containing malicious JavaScript to uploads/_pages/, where it executes in visitors' browsers upon access. A publicly available proof-of-concept exploit exists; active exploitation has not been confirmed in CISA KEV, but the persistent execution path and low-privilege requirement make this a realistic risk for multi-author deployments.
Maxsite Cms versions up to 109.1. contains a vulnerability that allows attackers to code injection (CVSS 7.3).
MaxSite CMS up to version 109 contains an improper access control vulnerability in the file editor plugin that allows authenticated remote attackers to upload arbitrary files by manipulating the file_path and content parameters in save-file-ajax.php. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to early disclosure attempts, leaving affected installations unpatched.
MaxSite CMS up to version 109 contains an unrestricted file upload vulnerability in the auto_post plugin's upload handler that allows authenticated remote attackers to bypass file upload restrictions by manipulating HTTP headers (X-Requested-FileName and X-Requested-FileUpDir). Public exploit code is available, though EPSS score (0.05%) suggests limited real-world exploitation despite the publicly disclosed proof-of-concept.
Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PHP object injection in MaxSite CMS through version 109.6 lets unauthenticated remote attackers forge valid ci_session cookies and pass attacker-controlled serialized data to an unrestricted unserialize() call. Because the framework ships a hardcoded encryption key, an attacker can sign forged session cookies that pass integrity checks, instantiate arbitrary PHP objects, and trigger magic methods to corrupt application state or achieve remote code execution when suitable gadget classes are present. Publicly available exploit code exists (reported by VulnCheck); this is a deserialization flaw (CWE-502) with a full-impact CVSS 4.0 score of 9.2.
Authentication bypass in MaxSite CMS versions 0.78 through 109.6 lets unauthenticated remote attackers forge valid administrator session cookies because the framework ships with a hardcoded session encryption key in application/config/config.php that installers never rotate. Using the publicly known key, an attacker computes a valid HMAC-SHA1 over a crafted ci_session cookie to impersonate an admin, defeating the is_login() and mso_check_allow() authorization checks. Publicly available exploit code exists (published by VulnCheck / EviL0rd); there is no evidence of active exploitation in CISA KEV at time of analysis.
Local file inclusion in MaxSite CMS through 109.6 allows unauthenticated remote attackers to execute privileged PHP handler files by supplying base64-encoded path traversal sequences to the ajax and require-maxsite dispatcher endpoints. The encoding technique bypasses the dispatchers' path validation logic, enabling attackers to reach admin-gated handler actions entirely without credentials. A public proof-of-concept exploit was published on 2026-09-08; the vulnerability spans essentially the entire version history of the product (0.78 through 109.6), and no patched release has been confirmed at time of analysis.
Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.
Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated AJAX endpoints by sending any X-Requested-With header alongside a base64-encoded path that resolves to any *-ajax.php file in the codebase. Because the dispatcher never verifies an admin session, attackers can invoke privileged plugin operations - demonstrated by manipulating poll states and vote counts - and can amplify any dangerous action exposed by admin-only AJAX files across the plugin tree. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a fixed release (109.6) is available.
Stored cross-site scripting in MaxSite CMS versions 0.94 through 109.6 stems from the admin_page plugin's upload handler accepting unrestricted HTML file uploads, placing attacker-controlled content in a publicly accessible web directory. Any authenticated low-privilege user can upload an HTML file containing malicious JavaScript to uploads/_pages/, where it executes in visitors' browsers upon access. A publicly available proof-of-concept exploit exists; active exploitation has not been confirmed in CISA KEV, but the persistent execution path and low-privilege requirement make this a realistic risk for multi-author deployments.
Maxsite Cms versions up to 109.1. contains a vulnerability that allows attackers to code injection (CVSS 7.3).
MaxSite CMS up to version 109 contains an improper access control vulnerability in the file editor plugin that allows authenticated remote attackers to upload arbitrary files by manipulating the file_path and content parameters in save-file-ajax.php. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to early disclosure attempts, leaving affected installations unpatched.
MaxSite CMS up to version 109 contains an unrestricted file upload vulnerability in the auto_post plugin's upload handler that allows authenticated remote attackers to bypass file upload restrictions by manipulating HTTP headers (X-Requested-FileName and X-Requested-FileUpDir). Public exploit code is available, though EPSS score (0.05%) suggests limited real-world exploitation despite the publicly disclosed proof-of-concept.
Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.