Haxtheweb Haxcms-php vulnerabilities

• haxtheweb haxcms-php haxtheweb/haxcms-php uses insecure method for generating salt CVE-2026-46493 7.5 HighJune 5, 2026
• haxtheweb haxcms-php HAXCMS PHP has a File Upload Validation Bypass CVE-2026-46400 8.7 HighJune 5, 2026
• haxtheweb haxcms-php HAX CMS Missing Secure Flag on Cookie CVE-2026-46398 8.8 HighJune 5, 2026
• haxtheweb haxcms-php, haxcms-nodejs +1 more haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 CVE-2026-46397 6.5 MediumJune 5, 2026
• haxtheweb haxcms-php HAX CMS Vulnerable to Command Injection using Git.php CVE-2026-46394 Public exploit 7.7 HighJune 5, 2026
• haxtheweb haxcms-php HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation CVE-2026-46392 8.7 HighJune 5, 2026
• haxtheweb haxcms-php HAX CMS has Unauthenticated Git Access via User-Controlled Key CVE-2026-46390 6.9 MediumJune 5, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more Authenticated Remote Code Execution via File Overwrite CVE-2026-46399 9.4 CriticalJune 5, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint CVE-2026-48527 Fix available 8.7 HighMay 29, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack CVE-2026-46511 Fix available 8.7 HighMay 19, 2026
• haxtheweb haxcms-nodejs, haxcms-php +1 more HAXcms createSite SSRF Enables Arbitrary File Read CVE-2026-46393 Fix available 7.1 HighMay 19, 2026