Skip to content
OpenAdvisories

Package · Packagist

elmsln/haxcms

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.3
    CVE-2025-54378

    HAX CMS Backend Lacks Comprehensive Authorization Checks

    HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. B…

    haxtheweb issues @haxtheweb/haxcms-nodejs elmsln/haxcms npm Packagist
  • Medium 4.3
    CVE-2025-54139

    HAX CMS' application pages are vulnerable to clickjacking

    HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other web…

    haxtheweb issues @haxtheweb/haxcms-nodejs elmsln/haxcms npm Packagist
  • Medium 6.5
    CVE-2025-49138

    HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

    HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the s…

    haxtheweb issues elmsln/haxcms Packagist
  • High 8.5
    CVE-2025-49137

    Hax CMS Stored Cross-Site Scripting vulnerability

    HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endp…

    haxtheweb issues elmsln/haxcms Packagist