Product
high
advisory
Local File Inclusion in MaxSite CMS via Ajax Dispatchers
1 rule 1 TTP 1 CVEMaxSite CMS versions up to 109.6 contain a local file inclusion vulnerability in its ajax and require-maxsite dispatchers allowing unauthenticated attackers to execute arbitrary privileged handlers.
MaxSite CMS
web-application
lfi
vulnerability
1r
1t
1c
critical
advisory
Hardcoded Session Encryption Key in MaxSite CMS
2 TTPs 1 CVEMaxSite CMS versions 109.6 and earlier contain a hardcoded encryption key in application/config/config.php, enabling unauthenticated attackers to forge administrator session cookies.
MaxSite CMS
web
cve
authentication-bypass
2t
1c