haxtheweb

Records33All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high17CVSS 7.0–8.9

Exploited now

haxtheweb records in CISA KEV

No haxtheweb vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Haxcms-nodejs 11 records HIGH Haxcms-php 8 records HIGH Haxiam 2 records HIGH

Records

33 records

TI-2026-34109 CVE-2026-46395 · GHSA-6c8g-9hfh-pq5h

HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

HIGH 81

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00295 Published 2026-06-05 Fixed in 26.0.0 CWE-200

TI-2026-34105 CVE-2026-46391 · GHSA-4fg7-f244-3j49

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

HIGH 79

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00457 Published 2026-06-05 Fixed in 26.0.0 CWE-183

TI-2026-27339 CVE-2026-35185

HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses

HIGH 77

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00369 Published 2026-04-06 Fixed in 25.0.0 CWE-284

TI-2026-34113 CVE-2026-46399

Authenticated Remote Code Execution via File Overwrite

HIGH 76

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00291 Published 2026-06-05 Fixed in 26.0.0 CWE-15

TI-2025-23152 CVE-2025-32028

HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution

HIGH 76

HAX CMS PHP allows you to manage your microsite universe with PHP backend.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.02038 Published 2025-04-08 Fixed in 10.0.3 CWE-434

TI-2026-34194 CVE-2026-46496 · GHSA-2m6p-hm3w-6jm3

HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

HIGH 75

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.0023 Published 2026-06-05 Fixed in 26.0.0 CWE-116

TI-2026-34110 CVE-2026-46396 · GHSA-jh3h-rpxg-fr36

HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover

HIGH 75

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.0023 Published 2026-06-05 Fixed in 26.0.0 CWE-79

TI-2026-35887 CVE-2026-48527 · GHSA-g2g8-95qg-v35h

HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint

HIGH 73

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00228 Published 2026-05-29 Fixed in 26.0.1, 26.0.2 CWE-79

TI-2026-34200 CVE-2026-46511 · GHSA-x3x5-7h4h-gwxg

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

HIGH 73

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00275 Published 2026-06-05 Fixed in 26.0.0 CWE-522

TI-2026-34114 CVE-2026-46400

HAXCMS PHP has a File Upload Validation Bypass

HIGH 73

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00387 Published 2026-06-05 Fixed in 25.0.0 CWE-434

TI-2026-34106 CVE-2026-46392

HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation

HIGH 73

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00272 Published 2026-06-05 Fixed in 26.0.0 CWE-178

TI-2025-33970 CVE-2025-54127 · GHSA-f38f-jvqj-mfg6

HAXcms's Insecure Default Configuration Leads to Unauthenticated Access

HIGH 73

HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00456 Published 2025-07-21 Fixed in 11.0.7 CWE-1188

TI-2025-31221 CVE-2025-49141 · GHSA-g4cf-pp4x-hqgw

HaxCMS-PHP Command Injection Vulnerability

HIGH 73

HAX CMS PHP allows users to manage their microsite universe with a PHP backend.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01554 Published 2025-06-09 Fixed in 11.0.3 CWE-78

TI-2025-34187 CVE-2025-54378 · GHSA-9jr9-8ff3-m894

HAX CMS Backend Lacks Comprehensive Authorization Checks

HIGH 71

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.0057 Published 2025-07-26 Fixed in 11.0.14 CWE-285

TI-2026-34104 CVE-2026-46390

HAX CMS has Unauthenticated Git Access via User-Controlled Key

HIGH 70

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00336 Published 2026-06-05 Fixed in 26.0.0 CWE-639

TI-2025-31217 CVE-2025-49137 · GHSA-2vc4-3hx7-v7v7

Hax CMS Stored Cross-Site Scripting vulnerability

HIGH 70

HAX CMS PHP allows users to manage their microsite universe with a PHP backend.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00295 Published 2025-06-09 Fixed in 11.0.0 CWE-79

TI-2026-34108 CVE-2026-46394

HAX CMS Vulnerable to Command Injection using Git.php

HIGH 69

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00768 Published 2026-06-05 Fixed in 26.0.0 CWE-78

TI-2025-33971 CVE-2025-54128 · GHSA-59g8-h59f-8hjp

HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting

HIGH 65

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.

CVSS 4.0HIGH 7.2 Network No auth User interaction EPSS 0.0023 Published 2025-07-21 Fixed in 11.0.8 CWE-79

TI-2026-34107 CVE-2026-46393 · GHSA-q862-gcgq-5m6g

HAXcms createSite SSRF Enables Arbitrary File Read

MEDIUM 64

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00238 Published 2026-06-05 Fixed in 26.0.0 CWE-918

TI-2025-33977 CVE-2025-54134 · GHSA-pjj3-j5j6-qj27

HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service

MEDIUM 64

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00472 Published 2025-07-21 Fixed in 11.0.9 CWE-20

TI-2026-34111 CVE-2026-46397

haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0

MEDIUM 62

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00289 Published 2026-06-05 Fixed in 26.0.0 CWE-22

TI-2026-34074 CVE-2026-46357 · GHSA-9r33-xhw8-4qqp

HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request

MEDIUM 62

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0024 Published 2026-06-05 Fixed in 26.0.0 CWE-20

TI-2025-31219 CVE-2025-49139 · GHSA-v3ph-2q5q-cg88

@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability

MEDIUM 62

HAX CMS PHP allows users to manage their microsite universe with a PHP backend.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00386 Published 2025-06-09 Fixed in 11.0.0 CWE-1021

TI-2025-31218 CVE-2025-49138 · GHSA-hxrr-x32w-cg8g

HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

MEDIUM 62

HAX CMS PHP allows users to manage their microsite universe with a PHP backend.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00547 Published 2025-06-09 Fixed in 11.0.0 CWE-22

TI-2025-33982 CVE-2025-54139 · GHSA-54vw-f4xf-f92j

HAX CMS' application pages are vulnerable to clickjacking

MEDIUM 60

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00356 Published 2025-07-22 Fixed in 11.0.13, 11.0.8 CWE-1021

Open these records in search →

Critical	6
High	17
Medium	10
Low	0
No CVSS	0