Threats tagged 'cve-2026-87929'

1 threat

Threats tagged 'cve-2026-87929'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.3	EPSS 0.5%	CVE-2026-87929MaxSite CMS · Use of Hard-coded Cryptographic Key Critical9.3EPSS 0.5%2026-09-09CVE Database V5CVE-2026-87929 MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions. EPSS 0.5%Vulnerability MaxSite	CVE Database V5	2026-09-09

Showing 1–1 of 1 result