CVE Feed

    Dashboard / CVE / CVE-2026-7011

    CVE-2026-7011

    A weakness has been identified in MaxSite CMS up to 109.3. Affected by this vulnerability is an unknown functionality of the file /admin/plugin_antispam of the component Antispam Plugin. Executing a manipulation of the argument f_logging_file can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 109.4 addresses this issue. This patch is called 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. Upgrading the affected component is advised. The vendor was informed early about this issue. They classify it as a "Self-XSS". They deployed a countermeasure: "Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display."

    Published:Apr 26, 2026
    Last Modified:Apr 27, 2026
    EPS:Apr 26, 2026
    EPSS Score:0.00011
    CVSS Score:2.4

    Affected Products

    Vendor
    Maxsite
    Product
    Cms

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-7016 (CVSS 1.9) — A vulnerability was found in MaxSite CMS up to 109.3. Impacted is an unknown function of the component ushki P…
    CVE-2026-7015 (CVSS 1.9) — A vulnerability has been found in MaxSite CMS up to 109.3. This issue affects some unknown processing of the c…
    CVE-2026-7014 (CVSS 1.9) — A flaw has been found in MaxSite CMS up to 109.3. This vulnerability affects unknown code of the component dow…
    CVE-2026-7013 (CVSS 1.9) — A security vulnerability has been detected in MaxSite CMS up to 109.3. Affected by this issue is some unknown …
    CVE-2026-7012 (CVSS 1.9) — A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirec…
    CVE-2026-3395 (CVSS 5.5) — A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsi…
    CVE-2025-12347 (CVSS 2.1) — A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file applica…
    CVE-2025-12346 (CVSS 2.1) — A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file app…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High