CVE-2026-37700
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Cross-Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by admin_page.
Risk Assessment
An attacker could steal administrator credentials or other confidential data stored in the browser session.
Recommendation
Update MaxSite CMS to the latest version containing the security fix.
Other vulnerabilities in MaxSite CMS
See all- CVE-2026-70554Critical
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation. Attackers can use gadget chains such as SoapClient or Imagick for remote code execution.
- CVE-2026-70553Critical
MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation. Attackers can exploit the db_dbprefix value to break out of a PHP string literal and add their own code.
- CVE-2026-70552Critical
MaxSite CMS 109.5 and earlier contain an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path to any *-ajax.php file. This can enable manipulation of poll states and vote counts.
Original NVD description (English source)
Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by admin_page