MaxSite vulnerabilities
We track 9 vulnerabilities in MaxSite products across 2 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on September 9, 2026.
Latest MaxSite vulnerabilities
- 8.1 High severity
MaxSite CMS: Deserialization of Untrusted Data
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods
- 9.8 Critical severity
MaxSite CMS: Use of Hard-coded Cryptographic Key
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_ses
- 8.2 High severity
MaxSite CMS: Improper Control of Filename for Include/Require Statement in PHP Program
MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can by
- 9.8 Critical severity
MaxSite CMS: Deserialization of Untrusted Data
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowli
- 9.8 Critical severity
MaxSite CMS: Improper Control of Generation of Code
MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. At
- 9.8 Critical severity
MaxSite CMS: Missing Authentication for Critical Functionality
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving t
- 9.8 Critical severity
CMS: Improper Control of Generation of Code
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection
- 8.8 High severity
CMS: Unrestricted Upload of File with Dangerous Type
A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file-ajax.php. Executing manipulation of the argument file_path/content can lead to unrestricted upload.
- 8.8 High severity
CMS: Unrestricted Upload of File with Dangerous Type
A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-R