CVE-2026-70553

Name of the Vulnerable Software and Affected Versions MaxSite CMS (affected versions not specified)

Description An issue allows unauthenticated attackers to achieve persistent remote code execution as the web-server process user. By submitting crafted POST requests to the 'install' endpoint after the installation process is complete, an attacker can inject arbitrary PHP code into the application configuration file located at application/config/database.php. This is achieved by providing a malicious db dbprefix value containing a single quote to break out of a PHP string literal and append controlled PHP statements that execute on every subsequent request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.