CVE-2026-7012

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7012", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-25T10:13:23.521Z", "datePublished": "2026-04-26T01:15:16.588Z", "dateUpdated": "2026-04-27T17:04:16.592Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T01:15:16.588Z"}, "title": "MaxSite CMS Redirect Plugin cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "MaxSite", "product": "CMS", "versions": [{"version": "109.0", "status": "affected"}, {"version": "109.1", "status": "affected"}, {"version": "109.2", "status": "affected"}, {"version": "109.3", "status": "affected"}, {"version": "109.4", "status": "unaffected"}], "modules": ["Redirect Plugin"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirect Plugin. The manipulation of the argument f_all/f_all404 results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 109.4 is able to mitigate this issue. The patch is identified as 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. You should upgrade the affected component. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-25T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-25T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-25T12:19:10.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "konchan (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359593", "name": "VDB-359593 | MaxSite CMS Redirect Plugin cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359593/cti", "name": "VDB-359593 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796737", "name": "Submit #796737 | MaxSite CMS 109.3 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-redirect-plugin-maxsite-cms.pdf.pdf", "tags": ["exploit"]}, {"url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/releases/tag/v109", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T17:03:48.771891Z", "id": "CVE-2026-7012", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:04:16.592Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"tags": ["x_open-source"], "title": "MaxSite CMS Redirect Plugin cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "konchan (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "MaxSite", "modules": ["Redirect Plugin"], "product": "CMS", "versions": [{"status": "affected", "version": "109.0"}, {"status": "affected", "version": "109.1"}, {"status": "affected", "version": "109.2"}, {"status": "affected", "version": "109.3"}, {"status": "unaffected", "version": "109.4"}]}], "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-25T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-25T12:19:10.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359593", "name": "VDB-359593 | MaxSite CMS Redirect Plugin cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359593/cti", "name": "VDB-359593 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796737", "name": "Submit #796737 | MaxSite CMS 109.3 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-redirect-plugin-maxsite-cms.pdf.pdf", "tags": ["exploit"]}, {"url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/releases/tag/v109", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirect Plugin. The manipulation of the argument f_all/f_all404 results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 109.4 is able to mitigate this issue. The patch is identified as 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. You should upgrade the affected component. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T01:15:16.588Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7012", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T17:03:48.771891Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-27T17:04:05.348Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-7012", "state": "PUBLISHED", "dateUpdated": "2026-04-26T01:15:16.588Z", "dateReserved": "2026-04-25T10:13:23.521Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-26T01:15:16.588Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Redirect Plugin"], "product": "CMS", "vendor": "MaxSite", "versions": [{"status": "affected", "version": "109.0"}, {"status": "affected", "version": "109.1"}, {"status": "affected", "version": "109.2"}, {"status": "affected", "version": "109.3"}, {"status": "unaffected", "version": "109.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirect Plugin. The manipulation of the argument f_all/f_all404 results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 109.4 is able to mitigate this issue. The patch is identified as 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. You should upgrade the affected component. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en MaxSite CMS hasta la versi\u00f3n 109.3. Esto afecta una parte desconocida del componente Plugin de Redirecci\u00f3n. La manipulaci\u00f3n del argumento f_all/f_all404 resulta en cross-site scripting. El ataque puede ser lanzado remotamente. El exploit es ahora p\u00fablico y puede ser usado. La actualizaci\u00f3n a la versi\u00f3n 109.4 es capaz de mitigar este problema. El parche se identifica como 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. Deber\u00eda actualizar el componente afectado. El proveedor fue informado tempranamente sobre este problema. Lo clasifican como un \u2019Self-XSS\u2019. Desplegaron una contramedida: \u2019No obstante, consideramos esto una violaci\u00f3n de los est\u00e1ndares de codificaci\u00f3n segura. La falta de filtrado mediante \u201chtmlspecialchars()\u201d ya ha sido corregida en el \u00faltimo parche para evitar la visualizaci\u00f3n incorrecta de datos.\u2019"}], "id": "CVE-2026-7012", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7012", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T17:03:48.771891Z", "version": "2.0.3"}}]}, "published": "2026-04-26T02:16:06.487", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/maxsite/cms/"}, {"source": "cna@vuldb.com", "url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7"}, {"source": "cna@vuldb.com", "url": "https://github.com/maxsite/cms/releases/tag/v109"}, {"source": "cna@vuldb.com", "url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-redirect-plugin-maxsite-cms.pdf.pdf"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/796737"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359593"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359593/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "109.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CMS", "source": "cna", "vendor": "MaxSite"}, "product": "cms", "vendor": "maxsite"}], "analysis": {"en": {"generated_at": "2026-04-28T05:27:12.154184+00:00", "value": {"mitigation_remediation": ["Apply the official patch commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 (available in release\u202f109.4).", "If an upgrade is not possible, implement input filtering on the f_all and f_all404 parameters so that only safe characters are accepted.", "Restrict access to the Redirect Plugin to authenticated administrators only and audit the component for similar input\u2011validation issues."], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The issue appears in MaxSite CMS versions up to 109.3, specifically affecting the Redirect Plugin component. Users running those versions are susceptible until they upgrade to 109.4 or later, where htmlspecialchars filtering has been added.", "description_and_impact": "The vulnerability is an uncontrolled input parameter in the f_all/f_all404 arguments of the Redirect Plugin that allows a remote attacker to embed arbitrary script. An attacker can execute scripts in the context of the site, potentially hijacking sessions, defacing content, or spreading malware. Because the flaw is stored in the CMS database, the injected payload can persist across users and sessions. The weakness is categorized as Cross\u2011Site Scripting, specifically an input validation flaw.", "risk_and_exploitability": "With a CVSS score of 4.8 the vulnerability is considered moderate. The EPSS score is less than 1\u202f%, indicating a low publicly observed exploitation probability, and the vulnerability is not listed in CISA\u2019s KEV. The attack is remote, via the web interface, and does not require authentication, so unauthenticated users may supply malicious payloads through the affected parameters."}}}}, "created": "2026-04-27T18:41:59.099777+00:00", "updated": "2026-04-28T05:30:23.368210+00:00", "vendors": ["maxsite", "maxsite$PRODUCT$cms"]}