Skip to content
OpenAdvisories

Package · Packagist

elmsln/haxcms

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.3
    CVE-2025-54378

    HAX CMS Backend Lacks Comprehensive Authorization Checks

    HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. B…

    haxtheweb issues @haxtheweb/haxcms-nodejs elmsln/haxcms npm Packagist
  • High 8.5
    CVE-2025-49137

    Hax CMS Stored Cross-Site Scripting vulnerability

    HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endp…

    haxtheweb issues elmsln/haxcms Packagist