CyberRota Analysis
AI-GeneratedMaxSite CMS versions 0.94 to 109.6 are vulnerable to a cross-site scripting flaw in the admin_page upload handler, allowing any logged-in user to upload HTML files containing malicious scripts. This vulnerability can lead to persistent stored cross-site scripting attacks, impacting users who access the uploaded files in their browsers. Organizations using affected versions should prioritize patching this vulnerability to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.