https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:00:49.440919+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-375043 EUVD-2026-375043 2026-10-02T11:00:49.443408+00:00 EUVD-2026-375043 https://cve.radiocsirt.org/vuln/fkie_cve-2026-87929 fkie_cve-2026-87929 2026-10-02T11:00:49.443440+00:00

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.

 https://cve.radiocsirt.org/vuln/ghsa-x43r-8q5x-82p8 GHSA-x43r-8q5x-82p8 2026-10-02T11:00:49.443471+00:00

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.