Maian develops a suite of modestly sized web-application components—including galleries, weblogs, guestbooks, link managers, and recipe tools—that occupy a niche in small-website and hobby-site deployments despite their limited footprint. The vendor's exposure recurs through authentication and input-handling weaknesses, particularly improper authentication schemes and cross-site scripting in form processing, alongside application-layer defects; public exploit code has frequently been made available for these classes of flaws. Defenders should treat Maian components as requiring careful input validation review and strong authentication controls where exposed; current severity and exploitation metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Maian over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-3318HIGH admin/index.php in Maian Weblog 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary weblog_cookie cookie. | Jul 25, 2008 | 7.5 | 33 | NO | YES |
CVE-2008-3319HIGH admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie. | Jul 25, 2008 | 7.5 | 31 | NO | YES |
CVE-2008-3322HIGH admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipe_cookie cookie. | Jul 25, 2008 | 7.5 | 31 | NO | YES |
CVE-2008-3320HIGH admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbook_cookie cookie. | Jul 25, 2008 | 7.5 | 30 | NO | YES |
CVE-2012-2405HIGH Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113. | Apr 22, 2012 | 10.0 | 29 | NO | NO |
CVE-2006-1259HIGH Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php. | Mar 19, 2006 | 7.5 | 20 | NO | NO |
CVE-2007-2077HIGH PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: th | Apr 18, 2007 | 7.5 | 19 | NO | NO |
CVE-2007-2076MEDIUM PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: th | Apr 18, 2007 | 6.8 | 18 | NO | NO |
CVE-2007-2078MEDIUM PHP remote file inclusion vulnerability in index.php in Maian Weblog 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: thi | Apr 18, 2007 | 6.8 | 18 | NO | NO |
CVE-2012-1113MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem in Gallery 2 before 2.3.2 and 3 before 3.0.3 allow remote attackers to inject arbitrary web scri | Apr 22, 2012 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Maian.
Media articles that mention a CVE ID that affects a product developed by Maian — matched by CVE ID, not by vendor name.