Maxsite - Maxsite Cms - CRITICAL - CVE-2026-87930. MaxSite CMS, in versions up to 109.6, is vulnerable to a PHP object injection flaw due to the improper handling of the ci_session cookie. This vulnerability allows unauthorized attackers to manipulate session cookies leveraging a hardcoded encryption key, enabling them to exploit magic methods and alter the application state. If certain gadget classes are available, this can lead to code execution, posing a significant threat to the integrity and security of the application. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io