CVE-2026-70554

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-705564.3Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Mo CVE-2026-705576.5diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and retur CVE-2026-705589.8Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(CVE-2026-705597.5Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits t CVE-2026-70568.8A vulnerability was detected in Tenda F456 1.0.0.5. Impacted is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter of the comp CVE-2026-705605.4Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticate CVE-2026-705616.5TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privi CVE-2026-705627.0Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-705638.1Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a n CVE-2026-705647.8Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-705657.0Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally.CVE-2026-705667.8Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.