# cve.now: Haxtheweb

The newest entries naming Haxtheweb as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-46357](https://cve.now/CVE-2026-46357.md): HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request (CVSS 6.5)
- [CVE-2026-46493](https://cve.now/CVE-2026-46493.md): haxtheweb/haxcms-php uses insecure method for generating salt (CVSS 7.5)
- [CVE-2026-46401](https://cve.now/CVE-2026-46401.md): HAX CMS PHP has Insufficient Session Expiration (CVSS 5.3)
- [CVE-2026-46400](https://cve.now/CVE-2026-46400.md): HAXCMS PHP has a File Upload Validation Bypass (CVSS 8.7)
- [CVE-2026-46398](https://cve.now/CVE-2026-46398.md): HAX CMS Missing Secure Flag on Cookie (CVSS 8.8)
- [CVE-2026-46397](https://cve.now/CVE-2026-46397.md): haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 (CVSS 6.5)
- [CVE-2026-46496](https://cve.now/CVE-2026-46496.md): HAX CMS: Stored XSS via '\<video-player\>' component allows arbitrary JavaScript execution and token theft (CVSS 9.3)
- [CVE-2026-46396](https://cve.now/CVE-2026-46396.md): HAX CMS has a stored XSS via \<iframe\> that allows access to sensitive client-side data and account takeover (CVSS 9.3)
- [CVE-2026-46511](https://cve.now/CVE-2026-46511.md): HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack (CVSS 8.7)
- [CVE-2026-46395](https://cve.now/CVE-2026-46395.md): HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation (CVSS 9.3)
- [CVE-2026-46394](https://cve.now/CVE-2026-46394.md): HAX CMS Vulnerable to Command Injection using Git.php (CVSS 7.7)
- [CVE-2026-46393](https://cve.now/CVE-2026-46393.md): HAXcms createSite SSRF Enables Arbitrary File Read (CVSS 7.1)
- [CVE-2026-46392](https://cve.now/CVE-2026-46392.md): HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation (CVSS 8.7)
- [CVE-2026-46391](https://cve.now/CVE-2026-46391.md): HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis (CVSS 8.7)
- [CVE-2026-46390](https://cve.now/CVE-2026-46390.md): HAX CMS has Unauthenticated Git Access via User-Controlled Key (CVSS 6.9)
- [CVE-2026-46399](https://cve.now/CVE-2026-46399.md): Authenticated Remote Code Execution via File Overwrite (CVSS 9.4)
- [CVE-2026-48527](https://cve.now/CVE-2026-48527.md): HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint (CVSS 8.7)
- [CVE-2026-35185](https://cve.now/CVE-2026-35185.md): HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses (CVSS 8.7)
- [CVE-2026-22704](https://cve.now/CVE-2026-22704.md): HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover (CVSS 8.1)
- [CVE-2025-54378](https://cve.now/CVE-2025-54378.md): HAX CMS Backend Lacks Comprehensive Authorization Checks (CVSS 8.3)
- [CVE-2025-54139](https://cve.now/CVE-2025-54139.md): HAX CMS' application pages are vulnerable to clickjacking (CVSS 4.3)
- [CVE-2025-54137](https://cve.now/CVE-2025-54137.md): NodeJS version of the HAX CMS application is distributed with Default Secrets (CVSS 7.3)
- [CVE-2025-54134](https://cve.now/CVE-2025-54134.md): HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service (CVSS 7.1)
- [CVE-2025-54129](https://cve.now/CVE-2025-54129.md): HAXiam allows for User Enumeration (CVSS 4.3)
- [CVE-2025-54128](https://cve.now/CVE-2025-54128.md): HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-54127](https://cve.now/CVE-2025-54127.md): HAXcms's Insecure Default Configuration Leads to Unauthenticated Access (CVSS 9.3)
- [CVE-2025-53642](https://cve.now/CVE-2025-53642.md): haxcms-nodejs and haxcms-php Improperly Terminate Sessions (CVSS 4.8)
- [CVE-2025-49141](https://cve.now/CVE-2025-49141.md): HaxCMS-PHP Command Injection Vulnerability (CVSS 8.6)
- [CVE-2025-49139](https://cve.now/CVE-2025-49139.md): @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability (CVSS 5.3)
- [CVE-2025-49138](https://cve.now/CVE-2025-49138.md): HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter (CVSS 6.5)
- [CVE-2025-49137](https://cve.now/CVE-2025-49137.md): Hax CMS Stored Cross-Site Scripting vulnerability (CVSS 8.5)
- [CVE-2025-48996](https://cve.now/CVE-2025-48996.md): Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint (CVSS 5.3)
- [CVE-2025-32028](https://cve.now/CVE-2025-32028.md): HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution (CVSS 10.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/haxtheweb
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.