CVE-2026-3395
Executing a manipulation can lead to code injection.
Does this matter?
Lower severity and a low EPSS score (3.88%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 109.2 will fix this issue. This patch is called 08937a3c5d672a242d68f53e9fccf8a748820ef3. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.
- CVSS 4.0
- 5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 3.88% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-94
- Affected
- max-3000/maxsite cms
- Source
- cna@vuldb.com
References
- https://github.com/maxsite/cms/Product
- https://github.com/maxsite/cms/commit/08937a3c5d672a242d68f53e9fccf8a748820ef3Patch
- https://vuldb.com/?ctiid.348281Permissions Required, VDB Entry
- https://vuldb.com/?id.348281Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.762169Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.