CVE-2026-70554: falha crítica em MaxSite CMS
MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 1.2%
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
MaxSite · MaxSite CMSCVEs relacionadas — MaxSite CMS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-70553CRITICALMaxSite CMS Unauthenticated RCE via Install EndpointEPSS 1.3%CVE-2026-70552CRITICALMaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.phpEPSS 0.8%CVE-2026-87930CRITICALMaxSite CMS through 109.6 PHP Object Injection via ci_sessionEPSS 0.6%CVE-2026-87927HIGHMaxSite CMS through 109.6 Local File Inclusion via ajax dispatcherEPSS 0.6%CVE-2026-87929CRITICALMaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption KeyEPSS 0.5%CVE-2026-87928MEDIUMMaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_pageEPSS 0.3%