Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@haxtheweb/haxcms-nodejs

16 known vulnerabilities (4 critical, 9 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
26.8.1 (Aug 14, 2026): no advisory affects it
Newest unaffected release
26.8.1 (Aug 14, 2026), the latest release
Advisories
16 · 4 critical, 9 high, 3 medium
Weekly downloads
983
Dependents
4
Releases
61 since 0.0.2 (Jun 17, 2024)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 16 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 16

  • CVE-2026-46357Medium 6.5

    HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request

    Affected: fixed in 26.0.0.

    Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure).

    The latest release, 26.8.1, is not affected.

    67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K).

  • CVE-2026-46496Critical 9.3

    HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

    Affected: fixed in 26.0.0.

    Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure).

    The latest release, 26.8.1, is not affected.

    67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K).

  • CVE-2026-46396Critical 9.3

    HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover

    Affected: fixed in 26.0.0.

    Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure).

    The latest release, 26.8.1, is not affected.

    67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K).

  • HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

    Affected: fixed in 26.0.0.

    Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure).

    The latest release, 26.8.1, is not affected.

    67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K).

  • CVE-2026-46395Critical 9.3

    HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

    Affected: fixed in 26.0.0.

    Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure).

    The latest release, 26.8.1, is not affected.

    67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K).

  • HAXcms createSite SSRF Enables Arbitrary File Read

    Affected: fixed in 26.0.0.

    Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure).

    The latest release, 26.8.1, is not affected.

    67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K).

  • HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint

    Affected: fixed in 26.0.1.

    Fixed in 26.0.1 (released May 21, 2026, 8 days before disclosure).

    The latest release, 26.8.1, is not affected.

    68% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K).

  • HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

    Affected: from 11.0.6, fixed in 25.0.0.

    Fixed in 25.0.0 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 26.8.1, is not affected.

    14% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (273).

  • HAX CMS Backend Lacks Comprehensive Authorization Checks

    Affected: fixed in 11.0.14.

    Fixed in 11.0.14 (released Jul 23, 2025, 3 days before disclosure).

    The latest release, 26.8.1, is not affected.

    62% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.2K).

  • CVE-2025-54139Medium 4.3

    HAX CMS' application pages are vulnerable to clickjacking

    Affected: fixed in 11.0.13.

    Fixed in 11.0.13 (released Jul 21, 2025, 1 day before disclosure).

    The latest release, 26.8.1, is not affected.

    60% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.1K).

  • NodeJS version of the HAX CMS application is distributed with Default Secrets

    Affected: fixed in 11.0.10.

    Fixed in 11.0.10 (released Jul 21, 2025, 1 day before disclosure).

    The latest release, 26.8.1, is not affected.

    57% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.1K).

  • HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service

    Affected: fixed in 11.0.9.

    Fixed in 11.0.9 (released Jul 21, 2025, the day of disclosure).

    The latest release, 26.8.1, is not affected.

    55% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1K).

  • HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting

    Affected: fixed in 11.0.8.

    Fixed in 11.0.8 (released Jul 21, 2025, the day of disclosure).

    The latest release, 26.8.1, is not affected.

    54% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1K).

  • CVE-2025-54127Critical 9.3

    HAXcms's Insecure Default Configuration Leads to Unauthenticated Access

    Affected: fixed in 11.0.7.

    Fixed in 11.0.7 (released Jul 21, 2025, the day of disclosure).

    The latest release, 26.8.1, is not affected.

    52% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (988).

  • HaxCMS-PHP Command Injection Vulnerability

    Affected: fixed in 11.0.3.

    Fixed in 11.0.3 (released Jun 9, 2025, the day of disclosure).

    The latest release, 26.8.1, is not affected.

    47% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (895).

  • CVE-2025-49139Medium 5.3

    @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability

    Affected: fixed in 11.0.0.

    Fixed in 11.0.0 (released Jun 6, 2025, 3 days before disclosure).

    The latest release, 26.8.1, is not affected.

    44% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (825).