CVE-2026-3395CWE-74CWE-94

MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection

Medium · published March 1, 2026

CVSS v4.0
6.9
EPSS
3%
Percentile
84.8
In the wild
Unconfirmed
What it is

A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 109.2 will fix this issue. This patch is called 08937a3c5d672a242d68f53e9fccf8a748820ef3. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.02525 · 84.8th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-03-01T14:02Z
EPSS history
Timeline
  • 01 MAR 14:02Z
    MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection
    cvelistv5