Vulnerabilities

TI-2026-18231 CVE-2026-22704 · GHSA-3fm2-xfq7-7778

HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

LOW 39

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 8.1 Network Low privileges User interaction EPSS 0.01026 Published 2026-01-10 Fixed in 25.0.0 CWE-79

TI-2025-34187 CVE-2025-54378 · GHSA-9jr9-8ff3-m894

HAX CMS Backend Lacks Comprehensive Authorization Checks

HIGH 71

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.0057 Published 2025-07-26 Fixed in 11.0.14 CWE-285

TI-2025-33982 CVE-2025-54139 · GHSA-54vw-f4xf-f92j

HAX CMS' application pages are vulnerable to clickjacking

MEDIUM 60

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00356 Published 2025-07-22 Fixed in 11.0.13, 11.0.8 CWE-1021

TI-2025-33980 CVE-2025-54137 · GHSA-5fpv-5qvh-7cf3

NodeJS version of the HAX CMS application is distributed with Default Secrets

LOW 32

HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00394 Published 2025-07-22 Fixed in 11.0.10 CWE-1392

TI-2025-33977 CVE-2025-54134 · GHSA-pjj3-j5j6-qj27

HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service

MEDIUM 64

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00472 Published 2025-07-21 Fixed in 11.0.9 CWE-20

TI-2025-33971 CVE-2025-54128 · GHSA-59g8-h59f-8hjp

HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting

HIGH 65

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.

CVSS 4.0HIGH 7.2 Network No auth User interaction EPSS 0.0023 Published 2025-07-21 Fixed in 11.0.8 CWE-79

TI-2025-33970 CVE-2025-54127 · GHSA-f38f-jvqj-mfg6

HAXcms's Insecure Default Configuration Leads to Unauthenticated Access

HIGH 73

HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00456 Published 2025-07-21 Fixed in 11.0.7 CWE-1188

TI-2025-33568 CVE-2025-53642

haxcms-nodejs and haxcms-php Improperly Terminate Sessions

LOW 28

haxcms-nodejs and haxcms-php are backends for HAXcms.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00194 Published 2025-07-11 Fixed in 11.0.6 CWE-613

TI-2025-31221 CVE-2025-49141 · GHSA-g4cf-pp4x-hqgw

HaxCMS-PHP Command Injection Vulnerability

HIGH 73

HAX CMS PHP allows users to manage their microsite universe with a PHP backend.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01554 Published 2025-06-09 Fixed in 11.0.3 CWE-78

TI-2025-31219 CVE-2025-49139 · GHSA-v3ph-2q5q-cg88

@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability

MEDIUM 62

HAX CMS PHP allows users to manage their microsite universe with a PHP backend.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00386 Published 2025-06-09 Fixed in 11.0.0 CWE-1021

TI-2025-31217 CVE-2025-49137 · GHSA-2vc4-3hx7-v7v7

Hax CMS Stored Cross-Site Scripting vulnerability

HIGH 70

HAX CMS PHP allows users to manage their microsite universe with a PHP backend.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00295 Published 2025-06-09 Fixed in 11.0.0 CWE-79

Vulnerabilities

Filters