CVE-2021-35265

Name of the Vulnerable Software and Affected Versions: MaxSite CMS versions prior to V106

Description: A reflected cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script to a page via the "product/page/*" API endpoint. This enables attackers to execute malicious scripts on the victim's browser, potentially leading to unauthorized actions or data theft.

Recommendations: For MaxSite CMS versions prior to V106, update to version V106 or later to resolve the issue. As a temporary workaround, consider restricting access to the "product/page/*" API endpoint to minimize the risk of exploitation.