Submit #762169: maxsite CMS CMS 109.1 Code Injection

Vuldb • March 1, 2026

Share: View original

Attacker-controlled input sent to the MarkItUp preview AJAX endpoint is passed through content hooks and reaches `eval()` in `run_php`, enabling ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-3395: Code Injection Vulnerability in MaxSite CMS A code injection vulnerability has been identified in MaxSite CMS versions up to 109.1, affecting the MarkItUp Preview AJAX Endpoint. This flaw allows remote attackers to execute arbitrary code via manipulated input sent to the eval function. Users are advised to upgrade to version 109.2, which includes a patch to address this issue. 2 sources 40

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

T1059 - Command and Scripting Interpreter

Platforms (2)

MarkItUp MaxSite CMS