What is CVE-2026-3395?

CVE-2026-3395 is a high-severity vulnerability in Max-3000 Maxsite Cms, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.3/10. Published 2026-03-01.

How severe is CVE-2026-3395?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2026-3395 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Max-3000 Maxsite Cms

CVE-2026-3395

A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 109.2 will fix this issue. This patch is called 08937a3c5d672a242d68f53e9fccf8a748820ef3. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.

Published 2026-03-01 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.025 (83.9th percentile), scored 2026-09-28.

Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 83.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.039 · newest: 0.025 · change: -0.014

Affected products

Max-3000 Maxsite Cms
Maxsite Cms — versions 109.0, 109.1, 109.2

Weakness classification (CWE)

Public proof-of-concept exploits

References

vuldb.com/ (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
vuldb.com/ (signature, Permissions Required, permissions-required, VDB Entry)
vuldb.com/ (VDB Entry, Third Party Advisory, third-party-advisory)
github.com/maxsite/cms/commit/08937a3c5d672a242d68f53e9fccf8a748820ef3 (Patch, patch)
github.com/maxsite/cms/ (Product, product)

Frequently asked questions

What is CVE-2026-3395?: CVE-2026-3395 is a high-severity vulnerability in Max-3000 Maxsite Cms, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.3/10. Published 2026-03-01.
How severe is CVE-2026-3395?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2026-3395 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.