CVE-2026-7015

{
  "id": "CVE-2026-7015",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-26T03:16:00.530",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been found in MaxSite CMS up to 109.3. This issue affects some unknown processing of the component Guestbook Plugin. Such manipulation of the argument f_text/f_slug/f_limit/f_email leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 109.4 is capable of addressing this issue. The name of the patch is 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. It is suggested to upgrade the affected component. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad en MaxSite CMS hasta la versión 109.3. Este problema afecta a algún procesamiento desconocido del componente Guestbook Plugin. Tal manipulación del argumento f_text/f_slug/f_limit/f_email lleva a secuencias de comandos en sitios cruzados. El ataque puede ser lanzado remotamente. El exploit ha sido divulgado al público y puede ser usado. La actualización a la versión 109.4 es capaz de abordar este problema. El nombre del parche es 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. Se sugiere actualizar el componente afectado. El proveedor fue informado tempranamente sobre este problema. Lo clasifican como un ’Self-XSS’. Desplegaron una contramedida: ’No obstante, consideramos esto una violación de los estándares de codificación segura. La falta de filtrado mediante “htmlspecialchars()” ya ha sido corregida en el último parche para evitar la visualización incorrecta de datos.’"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MaxSite",
          "product": "CMS",
          "modules": [
            "Guestbook Plugin"
          ],
          "versions": [
            {
              "version": "109.0",
              "status": "affected"
            },
            {
              "version": "109.1",
              "status": "affected"
            },
            {
              "version": "109.2",
              "status": "affected"
            },
            {
              "version": "109.3",
              "status": "affected"
            },
            {
              "version": "109.4",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 1.9,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 2.4,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 1.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N",
          "baseScore": 3.3,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "MULTIPLE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "NONE"
        },
        "baseSeverity": "LOW",
        "exploitabilityScore": 6.4,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-27T13:09:19.186040Z",
          "id": "CVE-2026-7015",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/maxsite/cms/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/maxsite/cms/releases/tag/v109",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-guestbook-plugin-maxsite-cms.pdf.pdf",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/submit/796740",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/359595",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/359595/cti",
      "source": "[email protected]"
    }
  ]
}