CVE-2026-37700 describes a Cross Site Scripting (CWE-79) vulnerability in MaxSite CMS v109.2. This vulnerability allows a remote attacker with low privileges and requiring user interaction to exploit the backend page file upload endpoint used by admin_page to obtain sensitive information. The CVSS vector indicates network attack vector, low attack complexity, privileges required, user interaction required, scope changed, and limited confidentiality impact. No known exploits in the wild or vendor advisories with patch information are currently available.

The vulnerability can lead to limited confidentiality loss by allowing an attacker to obtain sensitive information through XSS on the backend file upload page. There is no impact on integrity or availability reported. The attack requires privileges and user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the backend file upload endpoint and monitor for suspicious activity involving admin_page. Avoid executing untrusted scripts in the affected interface.