Skip to content
OpenAdvisories

Package · npm

@haxtheweb/haxcms-nodejs

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-46496

    HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs i…

    haxtheweb haxcms-nodejs video-player @haxtheweb/haxcms-nodejs npm
  • Critical 9.3
    CVE-2026-46396

    HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `sr…

    haxtheweb haxcms-nodejs video-player iframe-loader npm
  • Critical 9.3
    CVE-2026-46395 Public exploit

    HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker …

    haxtheweb haxcms-nodejs @haxtheweb/haxcms-nodejs npm
  • Critical 9.3
    CVE-2025-54127

    HAXcms's Insecure Default Configuration Leads to Unauthenticated Access

    HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not…

    haxtheweb issues @haxtheweb/haxcms-nodejs npm