Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2005-1091: Maxthon 1.2.0/1.2.1 lets attackers run restricted plugins
CVE-2005-1091 · published 21 years ago
Summary
The web browser Maxthon versions 1.2.0 and 1.2.1 can be tricked into loading a special script file that bypasses its built‑in security checks. This allows a remote attacker to use functions that are meant to be limited, potentially compromising the browser’s safety. Update to a newer version of Maxthon or apply the vendor’s recommended patch as soon as possible.
Original advisory text
Maxthon 1.2.0 and 1.2.1 allows remote attackers to bypass the security ID and use restricted plugin API functions via script that includes the max.src file into the source page.
Maxthon 1.2.0 and 1.2.1 allows remote attackers to bypass the security ID and use restricted plugin API functions via script that includes the max.src file into the source page.
References
- http://secunia.com/advisories/14918 Patch Vendor Advisory
- http://www.osvdb.org/15424
- http://www.raffon.net/advisories/maxthon/multvulns.html Exploit Patch Vendor Advisory
- http://www.securityfocus.com/bid/13073 Exploit
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Timeline
Published2 May 2005
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-1091 · NVD
Track software like this
Free during beta