Maxsite

Maxsite Cms

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2026-70553

  • EPSS 0.88%
  • Veröffentlicht 04.08.2026 20:16:56
  • Zuletzt bearbeitet 05.08.2026 20:17:17

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is co...

9.8

CVE-2026-70552

  • EPSS 0.57%
  • Veröffentlicht 04.08.2026 20:16:55
  • Zuletzt bearbeitet 05.08.2026 15:17:13

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path r...

9.8

CVE-2026-70554

  • EPSS 0.85%
  • Veröffentlicht 04.08.2026 20:11:55
  • Zuletzt bearbeitet 05.08.2026 15:17:13

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or cla...

4.1

CVE-2026-37700

  • EPSS 0.19%
  • Veröffentlicht 03.06.2026 00:00:00
  • Zuletzt bearbeitet 22.07.2026 20:10:00

Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by admin_page

6.1

CVE-2023-36291

  • EPSS 0.49%
  • Veröffentlicht 03.07.2023 21:15:09
  • Zuletzt bearbeitet 21.11.2024 08:09:30

Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file.

6.1

CVE-2021-35265

Exploit
  • EPSS 3.44%
  • Veröffentlicht 03.08.2021 12:15:07
  • Zuletzt bearbeitet 21.11.2024 06:12:10

A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page.