CVE-2026-3395mediumexploração observadaCWE-74CWE-94

CVE-2026-3395: falha de média gravidade em MaxSite CMS

MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar CMS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

70Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 6.9epss 4.0%
da publicação à armano mesmo dia
Publicada no NVD1 de mar.
1ª PoC1 de mar.
VulnCheck+130d
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 109.2 will fix this issue. This patch is called 08937a3c5d672a242d68f53e9fccf8a748820ef3. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
MaxSite · CMS
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — MaxSite CMS

No mesmo produto, das mais perigosas para as menos.

CVE-2025-12347MEDIUMMaxSite CMS save-file-ajax.php unrestricted uploadEPSS 0.4%CVE-2025-12346MEDIUMMaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted uploadEPSS 0.4%CVE-2026-7012MEDIUMMaxSite CMS Redirect Plugin cross site scriptingEPSS 0.3%CVE-2026-7014MEDIUMMaxSite CMS down_count Plugin cross site scriptingEPSS 0.3%CVE-2026-7011MEDIUMMaxSite CMS Antispam Plugin plugin_antispam cross site scriptingEPSS 0.3%CVE-2026-7016MEDIUMMaxSite CMS ushki Plugin cross site scriptingEPSS 0.2%