Maxsite Maxsite Cms
7 CVEs affecting Maxsite Maxsite Cms. Latest disclosed: 2026-09-09. Critical: 4, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-87929 | Critical | 9.8 | 2026-09-09 | MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing un… |
CVE-2026-70554 | Critical | 9.8 | 2026-08-04 | MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serial… |
CVE-2026-70553 | Critical | 9.8 | 2026-08-04 | MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuratio… |
CVE-2026-70552 | Critical | 9.8 | 2026-08-04 | MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gate… |
CVE-2026-87927 | High | 8.2 | 2026-09-09 | MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to ex… |
CVE-2026-87930 | High | 8.1 | 2026-09-09 | MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. A… |
CVE-2026-87928 | Medium | 5.4 | 2026-09-09 | MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload… |