Loading vulnerability…
CVE-2026-3395 is a remote code injection vulnerability in MaxSite CMS up to version 109.1. The flaw affects the MarkItUp Preview AJAX endpoint in the administrative plugin editor component, specifically the preview-ajax.php code path where attacker-controlled input reaches an eval operation. Because untrusted data is evaluated as code, a remote attacker can manipulate requests to the preview functionality and trigger execution of injected code on the server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository purpose: a local Docker lab to reproduce and compare vulnerable vs patched behavior for CVE-2026-3395 in MaxSite CMS (unauthenticated RCE when `run_php` plugin is enabled). Exploit capability/chain (as documented): an unauthenticated attacker can POST to an administrative AJAX preview endpoint (`application/maxsite/admin/plugins/editor_markitup/preview-ajax.php`) via MaxSite’s `/ajax/<base64-path>` router. The endpoint passes attacker-controlled POST data through `mso_hook()`. When the `run_php` plugin is loaded, it interprets `[php]...[/php]` blocks and evaluates them with `eval()`, enabling arbitrary PHP execution (demonstrated with `system('id')`). Patch behavior: the fixed version adds an authentication gate (`if (!is_login()) die('no login');`) and a referer/CSRF check (`mso_checkreferer();`), preventing unauthenticated access. Repository structure: - README.md: explains the vulnerability, provides the base64 route, and gives curl PoC requests for vulnerable (8081) and patched (8082) instances. - docker-compose.yml: orchestrates two MariaDB backends and two CMS containers, plus two Alpine “seed” jobs that automatically run the MaxSite installer via HTTP POST and verify installation. - vuln/Dockerfile and patched/Dockerfile: build Apache+PHP images, clone MaxSite CMS from GitHub at specific commits (vulnerable commit `a446f4c...` and patched commit `08937a3...`), and write `application/maxsite/mso_config.php` to deterministically autoload the `run_php` plugin after installation (ensuring the RCE chain is reproducible in the lab). Overall, this is a PoC/lab environment rather than a standalone exploit tool: it provides reproducible vulnerable and patched targets and a safe proof-of-impact request demonstrating unauthenticated RCE in the vulnerable build.
Repository contains a single Python3 exploit script and a README describing CVE-2026-3395: an unauthenticated RCE in MaxSite CMS <= 109.1 when the run_php plugin is enabled. The exploit targets the MarkItUp editor AJAX routing mechanism by POSTing to /ajax/<base64_path>, where the base64 decodes to admin/plugins/editor_markitup/preview-ajax.php. It sets a spoofed Referer header (weak referrer validation bypass) and supplies a 'data' parameter containing a [php]...[/php] shortcode. The run_php plugin evaluates this shortcode (via eval()), enabling arbitrary PHP execution; the provided payload calls system() to run a netcat FIFO reverse shell back to attacker-supplied --lhost/--lport. Structure: (1) 'MaxSite CMS unauthenticated RCE.py' is the entry point with argparse options target/lhost/lport, constructs the base64 path and POST request using requests, and checks HTTP 200 for success; (2) README.md documents affected versions, vulnerable files (preview-ajax.php and autosave-post-ajax.php), prerequisites, example detection payload, reverse shell payload, and mitigation/patch references.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Vulnerability in MaxSite CMS listed by the alert as being exploited in a large-scale CMS exploitation campaign.
A publicly known and patched vulnerability affecting MaxSite CMS that is being exploited in a large-scale CMS campaign to deploy webshells.
A vulnerability affecting MaxSite CMS, mentioned as part of a broader ACSC list of CMS/plugin vulnerabilities targeted in a global exploitation campaign.
A vulnerability in MaxSite CMS listed by ACSC as exploited in a global CMS webshell deployment campaign.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.