Haxtheweb vulnerabilities

Products

• Issues 19
• Haxcms-php 11
• Haxcms-nodejs 9
• Video-player 2

Newest

• haxtheweb haxcms-php haxtheweb/haxcms-php uses insecure method for generating salt CVE-2026-46493 7.5 HighJune 5, 2026
• haxtheweb issues HAX CMS PHP has Insufficient Session Expiration CVE-2026-46401 5.3 MediumJune 5, 2026
• haxtheweb haxcms-php HAXCMS PHP has a File Upload Validation Bypass CVE-2026-46400 8.7 HighJune 5, 2026
• haxtheweb haxcms-php HAX CMS Missing Secure Flag on Cookie CVE-2026-46398 8.8 HighJune 5, 2026
• haxtheweb haxcms-php, haxcms-nodejs +1 more haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 CVE-2026-46397 6.5 MediumJune 5, 2026
• haxtheweb haxcms-php HAX CMS Vulnerable to Command Injection using Git.php CVE-2026-46394 Public exploit 7.7 HighJune 5, 2026
• haxtheweb haxcms-php HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation CVE-2026-46392 8.7 HighJune 5, 2026
• haxtheweb haxcms-php HAX CMS has Unauthenticated Git Access via User-Controlled Key CVE-2026-46390 6.9 MediumJune 5, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more Authenticated Remote Code Execution via File Overwrite CVE-2026-46399 9.4 CriticalJune 5, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint CVE-2026-48527 Fix available 8.7 HighMay 29, 2026
• haxtheweb haxcms-nodejs HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request CVE-2026-46357 Fix available 6.5 MediumMay 19, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack CVE-2026-46511 Fix available 8.7 HighMay 19, 2026
• haxtheweb haxcms-nodejs, iframe-loader, video-player +2 more HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover CVE-2026-46396 Fix available 9.3 CriticalMay 19, 2026
• haxtheweb haxcms-nodejs HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation CVE-2026-46395 Public exploitFix available 9.3 CriticalMay 19, 2026
• haxtheweb @haxtheweb/open-apis HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis CVE-2026-46391 Public exploitFix available 8.7 HighMay 19, 2026
• haxtheweb video-player, haxcms-nodejs +1 more HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft CVE-2026-46496 Fix available 9.3 CriticalMay 19, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more HAXcms createSite SSRF Enables Arbitrary File Read CVE-2026-46393 Fix available 7.1 HighMay 19, 2026
• haxtheweb haxiam HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses CVE-2026-35185 8.7 HighApril 6, 2026
• haxtheweb issues, psu haxcms-nodejs +1 more HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover CVE-2026-22704 Public exploitFix available 8.1 HighJanuary 10, 2026
• psu haxcms-nodejs, haxcms-php, haxtheweb issues +2 more HAX CMS Backend Lacks Comprehensive Authorization Checks CVE-2025-54378 Fix available 8.3 HighJuly 25, 2025
• psu haxcms-nodejs, haxcms-php, haxtheweb issues +2 more HAX CMS' application pages are vulnerable to clickjacking CVE-2025-54139 Fix available 4.3 MediumJuly 21, 2025
• psu haxiam, haxtheweb issues +1 more HAXiam allows for User Enumeration CVE-2025-54129 4.3 MediumJuly 21, 2025
• haxtheweb issues, psu haxcms-nodejs +1 more NodeJS version of the HAX CMS application is distributed with Default Secrets CVE-2025-54137 Fix available 7.3 HighJuly 21, 2025
• haxtheweb issues, psu haxcms-nodejs +1 more HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service CVE-2025-54134 Fix available 7.1 HighJuly 21, 2025
• haxtheweb issues, psu haxcms-nodejs +1 more HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting CVE-2025-54128 Fix available 7.2 HighJuly 21, 2025
• psu haxcms-nodejs, haxtheweb issues +1 more HAXcms's Insecure Default Configuration Leads to Unauthenticated Access CVE-2025-54127 Fix available 9.3 CriticalJuly 21, 2025
• haxtheweb issues, psu haxcms-nodejs, haxcms-php +2 more haxcms-nodejs and haxcms-php Improperly Terminate Sessions CVE-2025-53642 4.8 MediumJuly 11, 2025
• psu haxcms-php, haxtheweb issues, psu haxcms-nodejs +2 more HaxCMS-PHP Command Injection Vulnerability CVE-2025-49141 Fix available 8.6 HighJune 9, 2025
• psu haxcms-nodejs, haxtheweb issues, psu haxcms-php +2 more @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability CVE-2025-49139 Fix available 5.3 MediumJune 9, 2025
• haxtheweb issues, psu haxcms-php +1 more HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter CVE-2025-49138 Fix available 6.5 MediumJune 9, 2025
• haxtheweb issues, psu haxcms-nodejs, haxcms-php +2 more Hax CMS Stored Cross-Site Scripting vulnerability CVE-2025-49137 Fix available 8.5 HighJune 9, 2025
• haxtheweb issues Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint CVE-2025-48996 5.3 MediumJune 2, 2025
• haxtheweb issues, psu haxcms-php +1 more HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution CVE-2025-32028 10.0 CriticalApril 8, 2025
• haxtheweb issues Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files CVE-2024-29188 Fix available 7.8 HighMarch 24, 2024
• wixtoolset project burn, haxtheweb issues +1 more WiX based installers are vulnerable to binary hijack when run as SYSTEM CVE-2024-29187 Fix available 7.3 HighMarch 24, 2024
• firegiant wix toolset, haxtheweb issues +1 more WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges CVE-2024-24810 Fix available 8.3 HighFebruary 7, 2024