Skip to content
OpenAdvisories

Package · npm

@haxtheweb/haxcms-nodejs

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-46395 Public exploit

    HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker …

    haxtheweb haxcms-nodejs @haxtheweb/haxcms-nodejs npm
  • High 8.1
    CVE-2026-22704 Public exploit

    HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.

    haxtheweb issues @haxtheweb/haxcms-nodejs npm