Issues
Haxtheweb · 16 CVEs
HAX CMS PHP has Insufficient Session Expiration
Jun 5, 2026
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
Jan 10, 2026
HAX CMS Backend Lacks Comprehensive Authorization Checks
Jul 26, 2025
HAX CMS' application pages are vulnerable to clickjacking
Jul 22, 2025
NodeJS version of the HAX CMS application is distributed with Default Secrets
Jul 22, 2025
HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
Jul 21, 2025
HAXiam allows for User Enumeration
Jul 21, 2025
HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting
Jul 21, 2025
HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
Jul 21, 2025
haxcms-nodejs and haxcms-php Improperly Terminate Sessions
Jul 11, 2025
HaxCMS-PHP Command Injection Vulnerability
Jun 9, 2025
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
Jun 9, 2025
HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter
Jun 9, 2025
Hax CMS Stored Cross-Site Scripting vulnerability
Jun 9, 2025
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint
Jun 2, 2025
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
Apr 8, 2025
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-46401 | HAX CMS PHP has Insufficient Session Expiration | MEDIUM | 0.50% | Jun 5, 2026 |
| CVE-2026-22704 | HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover | HIGH | 1.04% | Jan 10, 2026 |
| CVE-2025-54378 | HAX CMS Backend Lacks Comprehensive Authorization Checks | HIGH | 0.50% | Jul 26, 2025 |
| CVE-2025-54139 | HAX CMS' application pages are vulnerable to clickjacking | MEDIUM | 0.31% | Jul 22, 2025 |
| CVE-2025-54137 | NodeJS version of the HAX CMS application is distributed with Default Secrets | HIGH | 0.34% | Jul 22, 2025 |
| CVE-2025-54134 | HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service | HIGH | 0.41% | Jul 21, 2025 |
| CVE-2025-54129 | HAXiam allows for User Enumeration | MEDIUM | 0.27% | Jul 21, 2025 |
| CVE-2025-54128 | HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting | HIGH | 0.20% | Jul 21, 2025 |
| CVE-2025-54127 | HAXcms's Insecure Default Configuration Leads to Unauthenticated Access | CRITICAL | 0.40% | Jul 21, 2025 |
| CVE-2025-53642 | haxcms-nodejs and haxcms-php Improperly Terminate Sessions | MEDIUM | 0.18% | Jul 11, 2025 |
| CVE-2025-49141 | HaxCMS-PHP Command Injection Vulnerability | HIGH | 1.45% | Jun 9, 2025 |
| CVE-2025-49139 | @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability | MEDIUM | 0.37% | Jun 9, 2025 |
| CVE-2025-49138 | HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter | MEDIUM | 0.51% | Jun 9, 2025 |
| CVE-2025-49137 | Hax CMS Stored Cross-Site Scripting vulnerability | HIGH | 0.27% | Jun 9, 2025 |
| CVE-2025-48996 | Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint | MEDIUM | 0.36% | Jun 2, 2025 |
| CVE-2025-32028 | HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution | CRITICAL | 1.96% | Apr 8, 2025 |
Showing 1 to 16 of 16 CVEs