Haxtheweb vulnerabilities
33 CVEs and advisories name Haxtheweb as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-46357HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request
- CVE-2026-46493haxtheweb/haxcms-php uses insecure method for generating salt
- CVE-2026-46401HAX CMS PHP has Insufficient Session Expiration
- CVE-2026-46400HAXCMS PHP has a File Upload Validation Bypass
- CVE-2026-46398HAX CMS Missing Secure Flag on Cookie
- CVE-2026-46397haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0
- CVE-2026-46496HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
- CVE-2026-46396HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover
- CVE-2026-46511HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
- CVE-2026-46395HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation
- CVE-2026-46394HAX CMS Vulnerable to Command Injection using Git.php
- CVE-2026-46393HAXcms createSite SSRF Enables Arbitrary File Read
- CVE-2026-46392HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation
- CVE-2026-46391HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
- CVE-2026-46390HAX CMS has Unauthenticated Git Access via User-Controlled Key
- CVE-2026-46399Authenticated Remote Code Execution via File Overwrite
- CVE-2026-48527HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint
- CVE-2026-35185HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses
- CVE-2026-22704HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
- CVE-2025-54378HAX CMS Backend Lacks Comprehensive Authorization Checks
- CVE-2025-54139HAX CMS' application pages are vulnerable to clickjacking
- CVE-2025-54137NodeJS version of the HAX CMS application is distributed with Default Secrets
- CVE-2025-54134HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
- CVE-2025-54129HAXiam allows for User Enumeration
- CVE-2025-54128HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting
- CVE-2025-54127HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
- CVE-2025-53642haxcms-nodejs and haxcms-php Improperly Terminate Sessions
- CVE-2025-49141HaxCMS-PHP Command Injection Vulnerability
- CVE-2025-49139@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
- CVE-2025-49138HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter