Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-87930— MaxSite CMS through 109.6 PHP Object Injection via ci_session

Quick assessment

Affected
MaxSite MaxSite CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MaxSite CMS 在 109.6 版本之前，将 Cookie 直接传入 函数进行反序列化，且未对可反序列化的类进行任何限制，这使得未认证的攻击者能够注入任意 PHP 对象。 攻击者可以利用硬编码的加密密钥伪造有效的会话 Cookie，从而触发魔术方法（magic methods）。如果系统中存在合适的“ gadget 类”（即包含可执行逻辑的类），攻击者不仅可以破坏应用状态，还可能实现远程代码执行（RCE）。

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87930

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MaxSite CMS through 109.6 PHP Object Injection via ci_session
Source: CVE Program / CVE List V5
Vulnerability Description
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MaxSite MaxSite CMS 0.78 ~ 109.6 -

II. Public POCs for CVE-2026-87930

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87930

请登录查看更多情报信息。

Vendor Pages for CVE-2026-87930 (1)

Other References for CVE-2026-87930 (6)

Same Patch Batch · MaxSite · 2026-09-09 · 4 CVEs total

CVE-2026-87929 9.8 CRITICAL MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key
CVE-2026-87927 8.2 HIGH MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
CVE-2026-87928 5.4 MEDIUM MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page

IV. Related Vulnerabilities

Same product: MaxSite CMS
Same vendor: MaxSite
Same weakness: CWE-502

V. Comments for CVE-2026-87930

No comments yet

Leave a comment