Vulnerabilities

TI-2026-34074 CVE-2026-46357 · GHSA-9r33-xhw8-4qqp

HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request

MEDIUM 62

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0024 Published 2026-06-05 Fixed in 26.0.0 CWE-20

TI-2026-34192 CVE-2026-46493

haxtheweb/haxcms-php uses insecure method for generating salt

LOW 39

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00288 Published 2026-06-05 Fixed in 26.0.1 CWE-338

TI-2026-34115 CVE-2026-46401

HAX CMS PHP has Insufficient Session Expiration

MEDIUM 57

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00311 Published 2026-06-05 Fixed in 26.0.0 CWE-613

TI-2026-34114 CVE-2026-46400

HAXCMS PHP has a File Upload Validation Bypass

HIGH 73

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00387 Published 2026-06-05 Fixed in 25.0.0 CWE-434

TI-2026-34112 CVE-2026-46398

HAX CMS Missing Secure Flag on Cookie

MEDIUM 43

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00183 Published 2026-06-05 Fixed in 26.0.0 CWE-614

TI-2026-34111 CVE-2026-46397

haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0

MEDIUM 62

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00289 Published 2026-06-05 Fixed in 26.0.0 CWE-22

TI-2026-34194 CVE-2026-46496 · GHSA-2m6p-hm3w-6jm3

HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

HIGH 75

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.0023 Published 2026-06-05 Fixed in 26.0.0 CWE-116

TI-2026-34110 CVE-2026-46396 · GHSA-jh3h-rpxg-fr36

HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover

HIGH 75

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.0023 Published 2026-06-05 Fixed in 26.0.0 CWE-79

TI-2026-34200 CVE-2026-46511 · GHSA-x3x5-7h4h-gwxg

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

HIGH 73

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00275 Published 2026-06-05 Fixed in 26.0.0 CWE-522

TI-2026-34109 CVE-2026-46395 · GHSA-6c8g-9hfh-pq5h

HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

HIGH 81

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00295 Published 2026-06-05 Fixed in 26.0.0 CWE-200

TI-2026-34108 CVE-2026-46394

HAX CMS Vulnerable to Command Injection using Git.php

HIGH 69

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00768 Published 2026-06-05 Fixed in 26.0.0 CWE-78

TI-2026-34107 CVE-2026-46393 · GHSA-q862-gcgq-5m6g

HAXcms createSite SSRF Enables Arbitrary File Read

MEDIUM 64

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00238 Published 2026-06-05 Fixed in 26.0.0 CWE-918

TI-2026-34106 CVE-2026-46392

HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation

HIGH 73

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00272 Published 2026-06-05 Fixed in 26.0.0 CWE-178

TI-2026-34105 CVE-2026-46391 · GHSA-4fg7-f244-3j49

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

HIGH 79

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00457 Published 2026-06-05 Fixed in 26.0.0 CWE-183

TI-2026-34104 CVE-2026-46390

HAX CMS has Unauthenticated Git Access via User-Controlled Key

HIGH 70

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00336 Published 2026-06-05 Fixed in 26.0.0 CWE-639

TI-2026-34113 CVE-2026-46399

Authenticated Remote Code Execution via File Overwrite

HIGH 76

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00291 Published 2026-06-05 Fixed in 26.0.0 CWE-15

TI-2026-35887 CVE-2026-48527 · GHSA-g2g8-95qg-v35h

HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint

HIGH 73

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00228 Published 2026-05-29 Fixed in 26.0.1, 26.0.2 CWE-79

TI-2026-27339 CVE-2026-35185

HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses

HIGH 77

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00369 Published 2026-04-06 Fixed in 25.0.0 CWE-284

TI-2026-18231 CVE-2026-22704 · GHSA-3fm2-xfq7-7778

HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

LOW 39

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 8.1 Network Low privileges User interaction EPSS 0.01026 Published 2026-01-10 Fixed in 25.0.0 CWE-79

TI-2025-34187 CVE-2025-54378 · GHSA-9jr9-8ff3-m894

HAX CMS Backend Lacks Comprehensive Authorization Checks

HIGH 71

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.0057 Published 2025-07-26 Fixed in 11.0.14 CWE-285

TI-2025-33982 CVE-2025-54139 · GHSA-54vw-f4xf-f92j

HAX CMS' application pages are vulnerable to clickjacking

MEDIUM 60

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00356 Published 2025-07-22 Fixed in 11.0.13, 11.0.8 CWE-1021

TI-2025-33980 CVE-2025-54137 · GHSA-5fpv-5qvh-7cf3

NodeJS version of the HAX CMS application is distributed with Default Secrets

LOW 32

HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00394 Published 2025-07-22 Fixed in 11.0.10 CWE-1392

TI-2025-33977 CVE-2025-54134 · GHSA-pjj3-j5j6-qj27

HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service

MEDIUM 64

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00472 Published 2025-07-21 Fixed in 11.0.9 CWE-20

TI-2025-33972 CVE-2025-54129

HAXiam allows for User Enumeration

MEDIUM 53

HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00322 Published 2025-07-21 Fixed in 11.0.5 CWE-204

TI-2025-33971 CVE-2025-54128 · GHSA-59g8-h59f-8hjp

HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting

HIGH 65

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.

CVSS 4.0HIGH 7.2 Network No auth User interaction EPSS 0.0023 Published 2025-07-21 Fixed in 11.0.8 CWE-79

Vulnerabilities

Filters