Skip to content
OpenAdvisories

Vendor

MaxSite

16 known vulnerabilities.

Products

CMS 9 MaxSite CMS 7
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-87930 Public exploit

    MaxSite CMS through 109.6 PHP Object Injection via ci_session

    MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods…

    MaxSite MaxSite CMS
  • High 7.3
    CVE-2026-3395 Public exploit

    MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection

    A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injectio…

    MaxSite CMS