CVE-2022-25411: Max-3000 Maxsite CMS

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file.

Affected products

• Max-3000 Maxsite CMS: version 108 only

Published 2022-02-28. Last modified 2026-06-17.