Every CVE Search/ Get API key

CVE-2025-49137

Hax CMS Stored Cross-Site Scripting vulnerability

8.5 HighFix available

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a script tag, it does allow the use of other HTML tags to run JavaScript. Version 11.0.0 fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.29%Up 0.2 points since Jun 10, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.5

Hax CMS Stored Cross-Site Scripting vulnerability

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a script tag, it does allow the use of other HTML tags to run JavaScript. Version 11.0.0 fixes the issue.

Record
CVE-2025-49137
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness
CWE-79, CWE-80, CWE-87
Updated
2026-11-02
EUVDEUVD-2025-17562 8.5

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a script tag, it does allow the use of other HTML tags to run JavaScript. Version 11.0.0 fixes the issue.

Record
EUVD-2025-17562
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2vc4-3hx7-v7v7 8.5

Hax CMS Stored Cross-Site Scripting vulnerability

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

  1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

  1. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

  1. Open the site settings editor.

  1. Add JavaScript code to the URL field under the "Theme" header.

  1. Reload the page to run the script.

  1. The resulting page source will contain the script.

Record
GHSA-2vc4-3hx7-v7v7
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness
CWE-79, CWE-80, CWE-87
Updated
2026-11-02
NVD 8.5

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a script tag, it does allow the use of other HTML tags to run JavaScript. Version 11.0.0 fixes the issue.

Record
CVE-2025-49137
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79, CWE-80, CWE-87
Updated
2026-11-02
OSV 8.5

Hax CMS Stored Cross-Site Scripting vulnerability

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a script tag, it does allow the use of other HTML tags to run JavaScript. Version 11.0.0 fixes the issue.

Record
CVE-2025-49137
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness
CWE-79, CWE-80, CWE-87
Updated
2026-11-02
OSVGHSA-2vc4-3hx7-v7v7 8.5

Hax CMS Stored Cross-Site Scripting vulnerability

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

  1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

  1. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

  1. Open the site settings editor.

  1. Add JavaScript code to the URL field under the "Theme" header.

  1. Reload the page to run the script.

  1. The resulting page source will contain the script.

Record
GHSA-2vc4-3hx7-v7v7
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness
CWE-79, CWE-80, CWE-87
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
elmsln/haxcms
Packagist
 before 11.0.0
11.0.0
elmsln/haxcms
Packagist
 before 11.0.0, plus listed versions
0.0.10.1.00.11.00.12.00.12.1
Show 12 moreShow less
0.12.20.12.30.2.00.3.00.4.00.5.00.6.00.7.00.8.00.8.10.8.20.9.0
11.0.0

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-49137 is a high vulnerability (CVSS 8.5) in Haxtheweb Issues, published June 9, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in elmsln/haxcms 11.0.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open