TI-2025-23152 CVE-2025-32028
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
Priority HIGH 76
HAX CMS PHP allows you to manage your microsite universe with PHP backend.
haxtheweb
Records33All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high17CVSS 7.0–8.9
Exploited now
haxtheweb records in CISA KEVNo haxtheweb vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records in Haxcms-php · all components
TI-2025-31221 CVE-2025-49141 · GHSA-g4cf-pp4x-hqgw
HaxCMS-PHP Command Injection Vulnerability
Priority HIGH 73
HAX CMS PHP allows users to manage their microsite universe with a PHP backend.
TI-2025-34187 CVE-2025-54378 · GHSA-9jr9-8ff3-m894
HAX CMS Backend Lacks Comprehensive Authorization Checks
Priority HIGH 71
HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends.
TI-2025-31217 CVE-2025-49137 · GHSA-2vc4-3hx7-v7v7
Hax CMS Stored Cross-Site Scripting vulnerability
Priority HIGH 70
HAX CMS PHP allows users to manage their microsite universe with a PHP backend.
TI-2025-31219 CVE-2025-49139 · GHSA-v3ph-2q5q-cg88
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
Priority MEDIUM 62
HAX CMS PHP allows users to manage their microsite universe with a PHP backend.
TI-2025-31218 CVE-2025-49138 · GHSA-hxrr-x32w-cg8g
HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter
Priority MEDIUM 62
HAX CMS PHP allows users to manage their microsite universe with a PHP backend.
TI-2025-33982 CVE-2025-54139 · GHSA-54vw-f4xf-f92j
HAX CMS' application pages are vulnerable to clickjacking
Priority MEDIUM 60
HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend.
Priority LOW 28
haxcms-nodejs and haxcms-php are backends for HAXcms.