Maxboard multiple vulnerabilities
Priority MEDIUM 45CWE-288Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Code execution, SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288, CWE-434 and CWE-89.
Summary
SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.
Why it matters now
EPSS 0.01373 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Max Yi | Maxboard | up to 1.9.5.1 | — | No fix listed | CNA |
- Maxboard VendorMax Yi Affected up to 1.9.5.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26634
- 2026-10-03 Alias added: GHSA-f35m-48c3-v5mq
References
More Maxboard vulnerabilities
- TI-2021-08353 Maxboard Remote Code Execution CVSS 3.1CRITICAL 9.6
- TI-2021-08350 Maxboard SQL injection and LFI vulnerability CVSS 3.1CRITICAL 9.8
- TI-2021-08346 MaxBoard XSS and File Upload Vulnerability CVSS 3.1HIGH 8.1
Sources
- CVE-2021-26634 · CVE Program
- CVE-2021-26634 · NVD
- FIRST EPSS
- GHSA-f35m-48c3-v5mq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences