Skip to content
OpenAdvisories

Package · Packagist

elmsln/haxcms

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-54139

    HAX CMS' application pages are vulnerable to clickjacking

    HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other web…

    haxtheweb issues @haxtheweb/haxcms-nodejs elmsln/haxcms npm Packagist
  • Medium 6.5
    CVE-2025-49138

    HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

    HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the s…

    haxtheweb issues elmsln/haxcms Packagist