Haxtheweb Issues vulnerabilities

• haxtheweb issues HAX CMS PHP has Insufficient Session Expiration CVE-2026-46401 5.3 MediumJune 5, 2026
• haxtheweb issues, psu haxcms-nodejs +1 more HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover CVE-2026-22704 Public exploitFix available 8.1 HighJanuary 10, 2026
• psu haxcms-nodejs, haxcms-php, haxtheweb issues +2 more HAX CMS Backend Lacks Comprehensive Authorization Checks CVE-2025-54378 Fix available 8.3 HighJuly 25, 2025
• psu haxcms-nodejs, haxcms-php, haxtheweb issues +2 more HAX CMS' application pages are vulnerable to clickjacking CVE-2025-54139 Fix available 4.3 MediumJuly 21, 2025
• psu haxiam, haxtheweb issues +1 more HAXiam allows for User Enumeration CVE-2025-54129 4.3 MediumJuly 21, 2025
• haxtheweb issues, psu haxcms-nodejs +1 more NodeJS version of the HAX CMS application is distributed with Default Secrets CVE-2025-54137 Fix available 7.3 HighJuly 21, 2025
• haxtheweb issues, psu haxcms-nodejs +1 more HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service CVE-2025-54134 Fix available 7.1 HighJuly 21, 2025
• haxtheweb issues, psu haxcms-nodejs +1 more HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting CVE-2025-54128 Fix available 7.2 HighJuly 21, 2025
• psu haxcms-nodejs, haxtheweb issues +1 more HAXcms's Insecure Default Configuration Leads to Unauthenticated Access CVE-2025-54127 Fix available 9.3 CriticalJuly 21, 2025
• haxtheweb issues, psu haxcms-nodejs, haxcms-php +2 more haxcms-nodejs and haxcms-php Improperly Terminate Sessions CVE-2025-53642 4.8 MediumJuly 11, 2025
• psu haxcms-php, haxtheweb issues, psu haxcms-nodejs +2 more HaxCMS-PHP Command Injection Vulnerability CVE-2025-49141 Fix available 8.6 HighJune 9, 2025
• psu haxcms-nodejs, haxtheweb issues, psu haxcms-php +2 more @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability CVE-2025-49139 Fix available 5.3 MediumJune 9, 2025
• haxtheweb issues, psu haxcms-php +1 more HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter CVE-2025-49138 Fix available 6.5 MediumJune 9, 2025
• haxtheweb issues, psu haxcms-nodejs, haxcms-php +2 more Hax CMS Stored Cross-Site Scripting vulnerability CVE-2025-49137 Fix available 8.5 HighJune 9, 2025
• haxtheweb issues Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint CVE-2025-48996 5.3 MediumJune 2, 2025
• haxtheweb issues, psu haxcms-php +1 more HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution CVE-2025-32028 10.0 CriticalApril 8, 2025
• haxtheweb issues Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files CVE-2024-29188 Fix available 7.8 HighMarch 24, 2024
• wixtoolset project burn, haxtheweb issues +1 more WiX based installers are vulnerable to binary hijack when run as SYSTEM CVE-2024-29187 Fix available 7.3 HighMarch 24, 2024
• firegiant wix toolset, haxtheweb issues +1 more WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges CVE-2024-24810 Fix available 8.3 HighFebruary 7, 2024