Psu / Haxcms-Nodejs
11 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-22704 | HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover | HIGH | 8.1 | Jan 10, 2026 |
| CVE-2025-54378 | HAX CMS Backend Lacks Comprehensive Authorization Checks | HIGH | 8.3 | Jul 26, 2025 |
| CVE-2025-54139 | HAX CMS' application pages are vulnerable to clickjacking | MEDIUM | 6.1 | Jul 22, 2025 |
| CVE-2025-54137 | NodeJS version of the HAX CMS application is distributed with Default Secrets | HIGH | 7.3 | Jul 22, 2025 |
| CVE-2025-54134 | HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service | HIGH | 7.1 | Jul 21, 2025 |
| CVE-2025-54128 | HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting | HIGH | 7.2 | Jul 21, 2025 |
| CVE-2025-54127 | HAXcms's Insecure Default Configuration Leads to Unauthenticated Access | CRITICAL | 9.3 | Jul 21, 2025 |
| CVE-2025-53642 | haxcms-nodejs and haxcms-php Improperly Terminate Sessions | MEDIUM | 6.5 | Jul 11, 2025 |
| CVE-2025-49141 | HaxCMS-PHP Command Injection Vulnerability | HIGH | 8.8 | Jun 9, 2025 |
| CVE-2025-49139 | @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability | MEDIUM | 6.5 | Jun 9, 2025 |
| CVE-2025-49137 | Hax CMS Stored Cross-Site Scripting vulnerability | HIGH | 8.5 | Jun 9, 2025 |
Showing 1 to 11 of 11 CVEs