Haxtheweb / Haxcms-PHP
11 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-46493 | haxtheweb/haxcms-php uses insecure method for generating salt | HIGH | 7.5 | Jun 5, 2026 |
| CVE-2026-46400 | HAXCMS PHP has a File Upload Validation Bypass | HIGH | 8.7 | Jun 5, 2026 |
| CVE-2026-46398 | HAX CMS Missing Secure Flag on Cookie | HIGH | 8.8 | Jun 5, 2026 |
| CVE-2026-46397 | haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 | MEDIUM | 6.5 | Jun 5, 2026 |
| CVE-2026-46511 | HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack | HIGH | 8.7 | Jun 5, 2026 |
| CVE-2026-46394 | HAX CMS Vulnerable to Command Injection using Git.php | HIGH | 7.7 | Jun 5, 2026 |
| CVE-2026-46393 | HAXcms createSite SSRF Enables Arbitrary File Read | HIGH | 7.1 | Jun 5, 2026 |
| CVE-2026-46392 | HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation | HIGH | 8.7 | Jun 5, 2026 |
| CVE-2026-46390 | HAX CMS has Unauthenticated Git Access via User-Controlled Key | MEDIUM | 6.9 | Jun 5, 2026 |
| CVE-2026-46399 | Authenticated Remote Code Execution via File Overwrite | CRITICAL | 9.4 | Jun 5, 2026 |
| CVE-2026-48527 | HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint | HIGH | 8.7 | May 29, 2026 |
Showing 1 to 11 of 11 CVEs