CVE-2025-12346: falha de média gravidade em MaxSite CMS
MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-Requested-FileName/X-Requested-FileUpDir results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
MaxSite · CMSCVEs relacionadas — MaxSite CMS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-3395MEDIUMMaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injectionEPSS 4.0%CVE-2025-12347MEDIUMMaxSite CMS save-file-ajax.php unrestricted uploadEPSS 0.4%CVE-2026-7012MEDIUMMaxSite CMS Redirect Plugin cross site scriptingEPSS 0.3%CVE-2026-7014MEDIUMMaxSite CMS down_count Plugin cross site scriptingEPSS 0.3%CVE-2026-7011MEDIUMMaxSite CMS Antispam Plugin plugin_antispam cross site scriptingEPSS 0.3%CVE-2026-7016MEDIUMMaxSite CMS ushki Plugin cross site scriptingEPSS 0.2%