Skip to content
OpenAdvisories

Package · npm

@haxtheweb/haxcms-nodejs

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-46357

    HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is…

    haxtheweb haxcms-nodejs @haxtheweb/haxcms-nodejs npm
  • Medium 4.3
    CVE-2025-54139

    HAX CMS' application pages are vulnerable to clickjacking

    HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other web…

    haxtheweb issues @haxtheweb/haxcms-nodejs elmsln/haxcms npm Packagist
  • Medium 5.3
    CVE-2025-49139

    @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability

    HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the web…

    haxtheweb issues @haxtheweb/haxcms-nodejs npm