CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-70554 — MaxSite CMS contains a PHP object injection vulnerability that allows unauthenti...

·Source: NIST NVD

Updated:

Executive Summary

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during obje

Analysis

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions. CVSS Score: 9.8. Published: 2026-08-04T21:16:38.613.

Indicators of Compromise (1)

CVE (1)
CVE-2026-70554
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 4, 2026. Verified by: NIST.

Related Threats

HIGHVulnerability

NVD HIGH: CVE-2026-18854 — A vulnerability has been found in Shandong Hoteam PDM Product Data Management Sy...

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was

CVE-2026-18854
NIST NVD
MEDIUMVulnerability

CISA's New SBOM Rules Face Old Adoption Problem

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cisas-new-sbom-rules-face-old-adoption-problem-image_small-10-a-32416.jpg" align=right hspace=4><b>New Rules Add Hashes and Licenses - But Critics See Little to Drive Adoption</b><br>The U.S. Cybersecurity and Infrastructure Security Agency, the NSA, the FBI and 15 international partners released updated minimum elements for softw

Bank Info Security
LOWVulnerability

TP-Link patches Omada ZTP flaws allowing hackers to breach networks

TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices that could be chained with previously disclosed flaws to achieve remote code execution (RCE). [...]

BleepingComputer