CVE-2025-12347

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-12347

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12347.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-12347

Published

2025-10-28T03:15:34.117Z

Modified

2026-03-13T07:56:53.127637Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editorfiles/save-file-ajax.php. Executing manipulation of the argument filepath/content can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Affected packages

Git / github.com/maxsite/cms

Affected ranges

Type

GIT

Repo

https://github.com/maxsite/cms

Events

Introduced

Last affected

a14d90a5a8f3348c0bc3f3ad0efadf5d3eff910d

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "109"
        }
    ]
}

Affected versions

v0.*

v0.87

v0.87.1

v0.88

v0.89

v0.90

v0.91

v0.92

v0.93

v0.94

v0.95

v0.96

Other

v100

v101

v102

v104

v106

v107

v108

v109

v97

v98

v99

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12347.json"