PT-2025-44083 · Unknown · Maxsite Cms

V3Ged4G · Published 2025-10-28 · Updated 2025-10-28 · CVE-2025-12347

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 110

Description A flaw exists in MaxSite CMS that allows for unrestricted file uploads. This issue is related to the processing of the file path and content arguments within the file application/maxsite/admin/plugins/editor files/save-file-ajax.php. The attack can be carried out remotely. The exploit for this issue has been published.

Recommendations Update MaxSite CMS to version 110 or later.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-12347

Affected Products

Maxsite Cms

References · 8

• 🔥 https://note-hxlab.wetolink.com/share/lIWZkTHQPSVh · Exploit
• https://osv.dev/vulnerability/CVE-2025-12347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12347 · Security Note
• https://vuldb.com/?id.330137 · Note
• https://vuldb.com/?submit.674552 · Note
• https://t.me/CVEtracker/35928 · Telegram Post
• https://twitter.com/CVEnew/status/1983002396956770770 · Twitter Post
• https://vuldb.com/?ctiid.330137 · Note