Skip to content
OpenAdvisories

Package · npm

@haxtheweb/open-apis

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.7
    CVE-2026-46391 Public exploit

    HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be…

    haxtheweb @haxtheweb/open-apis @haxtheweb/open-apis npm
  • Medium 5.3
    CVE-2025-48996

    Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

    HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the `haxP…

    haxtheweb issues @haxtheweb/open-apis npm