CVE-2026-7014

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7014", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-25T10:13:29.850Z", "datePublished": "2026-04-26T02:30:20.930Z", "dateUpdated": "2026-04-27T13:24:06.084Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T02:30:20.930Z"}, "title": "MaxSite CMS down_count Plugin cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "MaxSite", "product": "CMS", "versions": [{"version": "109.0", "status": "affected"}, {"version": "109.1", "status": "affected"}, {"version": "109.2", "status": "affected"}, {"version": "109.3", "status": "affected"}, {"version": "109.4", "status": "unaffected"}], "modules": ["down_count Plugin"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in MaxSite CMS up to 109.3. This vulnerability affects unknown code of the component down_count Plugin. This manipulation of the argument f_file/f_prefix causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 109.4 is able to resolve this issue. Patch name: 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. The affected component should be upgraded. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-25T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-25T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-25T12:19:14.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "konchan (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359594", "name": "VDB-359594 | MaxSite CMS down_count Plugin cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359594/cti", "name": "VDB-359594 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796739", "name": "Submit #796739 | MaxSite CMS 109.3 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-down_count-plugin-maxsite-cms.pdf.pdf", "tags": ["exploit"]}, {"url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/releases/tag/v109", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T13:23:57.118493Z", "id": "CVE-2026-7014", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:24:06.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7014", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:23:57.118493Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:24:00.521Z"}}], "cna": {"tags": ["x_open-source"], "title": "MaxSite CMS down_count Plugin cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "konchan (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "MaxSite", "modules": ["down_count Plugin"], "product": "CMS", "versions": [{"status": "affected", "version": "109.0"}, {"status": "affected", "version": "109.1"}, {"status": "affected", "version": "109.2"}, {"status": "affected", "version": "109.3"}, {"status": "unaffected", "version": "109.4"}]}], "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-25T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-25T12:19:14.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359594", "name": "VDB-359594 | MaxSite CMS down_count Plugin cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359594/cti", "name": "VDB-359594 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796739", "name": "Submit #796739 | MaxSite CMS 109.3 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-down_count-plugin-maxsite-cms.pdf.pdf", "tags": ["exploit"]}, {"url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/releases/tag/v109", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in MaxSite CMS up to 109.3. This vulnerability affects unknown code of the component down_count Plugin. This manipulation of the argument f_file/f_prefix causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 109.4 is able to resolve this issue. Patch name: 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. The affected component should be upgraded. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T02:30:20.930Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7014", "state": "PUBLISHED", "dateUpdated": "2026-04-27T13:24:06.084Z", "dateReserved": "2026-04-25T10:13:29.850Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-26T02:30:20.930Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["down_count Plugin"], "product": "CMS", "vendor": "MaxSite", "versions": [{"status": "affected", "version": "109.0"}, {"status": "affected", "version": "109.1"}, {"status": "affected", "version": "109.2"}, {"status": "affected", "version": "109.3"}, {"status": "unaffected", "version": "109.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in MaxSite CMS up to 109.3. This vulnerability affects unknown code of the component down_count Plugin. This manipulation of the argument f_file/f_prefix causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 109.4 is able to resolve this issue. Patch name: 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. The affected component should be upgraded. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""}, {"lang": "es", "value": "Se ha encontrado un fallo en MaxSite CMS hasta la versi\u00f3n 109.3. Esta vulnerabilidad afecta a c\u00f3digo desconocido del componente plugin down_count. Esta manipulaci\u00f3n del argumento f_file/f_prefix causa cross-site scripting. El ataque puede ser iniciado remotamente. El exploit ha sido publicado y puede ser usado. Actualizar a la versi\u00f3n 109.4 puede resolver este problema. Nombre del parche: 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. El componente afectado deber\u00eda ser actualizado. El proveedor fue informado tempranamente sobre este problema. Lo clasifican como un \u2019Self-XSS\u2019. Desplegaron una contramedida: \u2019No obstante, consideramos esto una violaci\u00f3n de los est\u00e1ndares de codificaci\u00f3n segura. La falta de filtrado mediante \u2019htmlspecialchars()\u2019 ya ha sido corregida en el \u00faltimo parche para prevenir la visualizaci\u00f3n incorrecta de datos.\u2019"}], "id": "CVE-2026-7014", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7014", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T13:23:57.118493Z", "version": "2.0.3"}}]}, "published": "2026-04-26T03:16:00.353", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/maxsite/cms/"}, {"source": "cna@vuldb.com", "url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7"}, {"source": "cna@vuldb.com", "url": "https://github.com/maxsite/cms/releases/tag/v109"}, {"source": "cna@vuldb.com", "url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-down_count-plugin-maxsite-cms.pdf.pdf"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/796739"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359594"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359594/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "109.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CMS", "source": "cna", "vendor": "MaxSite"}, "product": "cms", "vendor": "maxsite"}], "analysis": {"en": {"generated_at": "2026-04-28T05:26:46.446490+00:00", "value": {"mitigation_remediation": ["Upgrade MaxSite CMS to version 109.4 or later, which contains the fixed down_count plugin.", "If an upgrade is not immediately possible, apply the individual patch commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 to the affected plugin files.", "Validate and sanitize all parameters passed to the down_count plugin, ensuring that inputs such as f_file and f_prefix are passed through htmlspecialchars() or equivalent before rendering."], "summary": {"action": "Patch Immediately", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All installations of MaxSite CMS up to but not including version 109.4 that use the down_count plugin are affected. The vulnerability is limited to the code of this specific plugin and can be remedied by upgrading the CMS to version 109.4 or higher, which contains the corrected plugin.", "description_and_impact": "A stored cross\u2011site scripting vulnerability exists in the down_count plugin of MaxSite CMS. By manipulating the f_file or f_prefix parameters, an attacker can inject arbitrary scripts that are rendered as page content. If successful, the injected code executes in the browsers of other users who view the affected page, potentially allowing session hijacking, credential theft, or defacement. The flaw is caused by inadequate filtering of user input before it is displayed and is classified by the vendor as a Self\u2011XSS type of misuse.", "risk_and_exploitability": "The overall cyber security impact rating is a moderate CVSS score of 4.8, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the general environment. The vulnerability is not listed as a known exploited vulnerability by CISA. An attacker can trigger the flaw remotely by sending crafted HTTP requests that provide malicious values for f_file or f_prefix; the published exploit demonstrates the feasibility of this attack vector."}}}}, "created": "2026-04-27T18:41:59.099164+00:00", "updated": "2026-04-28T05:30:23.366892+00:00", "vendors": ["maxsite", "maxsite$PRODUCT$cms"]}