Vulnerabilities

TI-2026-02931 CVE-2026-3395 · GHSA-g6fv-7p3q-j4fc

MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection

HIGH 70

A flaw has been found in MaxSite CMS up to 109.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.04021 Published 2026-03-01 Fixed in 109.2 CWE-74

TI-2025-11324 CVE-2025-12347 · GHSA-q9xr-p2gm-7fm6

MaxSite CMS save-file-ajax.php unrestricted upload

MEDIUM 57

A flaw has been found in MaxSite CMS up to 109.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00396 Published 2025-10-28 No fix listed CWE-284

TI-2025-11323 CVE-2025-12346 · GHSA-cfpx-6j59-hggc

MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload

LOW 24

A vulnerability was detected in MaxSite CMS up to 109.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00396 Published 2025-10-28 No fix listed CWE-284

TI-2022-09082 CVE-2022-25413 · GHSA-6wm7-76mj-3m8h

Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS)…

LOW 25

Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00493 Published 2022-02-28 No fix listed CWE-79

TI-2022-09081 CVE-2022-25412 · GHSA-wf72-g69g-r8cf

Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion…

LOW 37

Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01059 Published 2022-02-28 No fix listed CWE-22

TI-2022-09080 CVE-2022-25411 · GHSA-3pj9-f579-qchv

A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows…

MEDIUM 47

A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02972 Published 2022-02-28 No fix listed CWE-434

TI-2022-09079 CVE-2022-25410 · GHSA-2qf7-mf22-q87m

Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS)…

LOW 25

Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00493 Published 2022-02-28 No fix listed CWE-79

TI-2021-09291 CVE-2021-27983 · GHSA-m6q6-5v8h-vp6v

Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.

MEDIUM 48

Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03585 Published 2021-12-10 No fix listed

Vulnerabilities

Filters