PT-2026-22504 · Unknown+1 · Maxsite Cms+1

Mrsolo404 + 1 · Published 2026-03-01 · Updated 2026-03-06 · CVE-2026-3395

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions up to 109.1

Description A code injection issue exists in MaxSite CMS due to a flaw in the eval function within the file application/maxsite/admin/plugins/editor markitup/preview-ajax.php of the MarkItUp Preview AJAX Endpoint component. Remote attackers can exploit this to inject code. The exploit has been published and is potentially being used in attacks.

Recommendations Upgrade MaxSite CMS to version 109.2 to resolve this issue.

Fix

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

CVE-2026-3395

Affected Products

Markitup

Maxsite Cms

References · 15

• https://github.com/maxsite/cms/commit/08937a3c5d672a242d68f53e9fccf8a748820ef3 · Patch
• https://osv.dev/vulnerability/CVE-2026-3395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3395 · Security Note
• https://vuldb.com/?submit.762169 · Note
• https://vuldb.com/?ctiid.348281 · Note
• https://vuldb.com/?id.348281 · Note
• https://twitter.com/VulmonFeeds/status/2028115038523757026 · Twitter Post
• https://twitter.com/cracbot/status/2029874754413547844 · Twitter Post
• https://github.com/maxsite/cms · Note
• https://t.me/cveNotify/154246 · Telegram Post
• https://twitter.com/cyberbivash/status/2028143354442063874 · Twitter Post
• https://t.me/cveNotify/153675 · Telegram Post
• https://t.me/CVEtracker/46069 · Telegram Post
• https://twitter.com/vuldb/status/2027980690185457898 · Twitter Post
• https://twitter.com/cracbot/status/2029512302387753307 · Twitter Post