TI-2025-33982 Aliases CVE-2025-54139 GHSA-54vw-f4xf-f92j

HAX CMS' application pages are vulnerable to clickjacking

MEDIUM 60CWE-1021Published 2025-07-22 · Updated 2025-07-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-1021.

Summary

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00356 29th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed issues (haxtheweb): 11.0.13, 11.0.8@haxtheweb/haxcms-nodejs (npm): 11.0.13+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
haxtheweb	issues	before 11.0.13; before 11.0.8	11.0.13, 11.0.8	Patch available	CNA
—	@haxtheweb/haxcms-nodejs (npm)	before 11.0.13	11.0.13	Patch available	GHSA-54vw-f4xf-f92j
—	elmsln/haxcms (Packagist)	before 11.0.8	11.0.8	Patch available	GHSA-54vw-f4xf-f92j

issues Vendorhaxtheweb Affected before 11.0.13; before 11.0.8 Fixed in 11.0.13, 11.0.8 Patch available CNA
@haxtheweb/haxcms-nodejs (npm) Vendor— Affected before 11.0.13 Fixed in 11.0.13 Patch available GHSA-54vw-f4xf-f92j
elmsln/haxcms (Packagist) Vendor— Affected before 11.0.8 Fixed in 11.0.8 Patch available GHSA-54vw-f4xf-f92j

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:psu:haxcms-nodejs::::::node.js::*	11.0.6 to before 11.0.13	Vulnerable	haxtheweb
cpe:2.3:a:psu:haxcms-php::::::::	11.0.0 to before 11.0.8	Vulnerable	haxtheweb

cpe:2.3:a:psu:haxcms-nodejs:*:*:*:*:*:node.js:*:* Versions 11.0.6 to before 11.0.13 Vulnerable ·haxtheweb
cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:* Versions 11.0.0 to before 11.0.8 Vulnerable ·haxtheweb

Remediation

Fix · CNA issues (haxtheweb) Fixed in 11.0.13, 11.0.8
Fix · GHSA-54vw-f4xf-f92j @haxtheweb/haxcms-nodejs (npm) Fixed in 11.0.13 Advisory →
Fix · GHSA-54vw-f4xf-f92j elmsln/haxcms (Packagist) Fixed in 11.0.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-54139
2026-10-03 Alias added: GHSA-54vw-f4xf-f92j

References

Exploit 1

https://github.com/haxtheweb/issues/security/advisories/GHSA-54vw-f4xf-f92j

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-54139

Other 1

https://github.com/haxtheweb/issues

TI-2025-33970 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access CVSS 4.0CRITICAL 9.3
TI-2025-31221 HaxCMS-PHP Command Injection Vulnerability CVSS 3.1HIGH 8.8
TI-2025-34187 HAX CMS Backend Lacks Comprehensive Authorization Checks CVSS 3.1HIGH 8.3
TI-2025-31217 Hax CMS Stored Cross-Site Scripting vulnerability CVSS 3.1HIGH 8.5
TI-2025-33971 HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting CVSS 4.0HIGH 7.2
TI-2025-33977 HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service CVSS 4.0HIGH 7.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences