Skip to content
OpenAdvisories

Vendor

haxtheweb

33 known vulnerabilities.

Products

issues 16 haxcms-php 11 haxcms-nodejs 9 video-player 2 HAXiam 1 @haxtheweb/open-apis 1 iframe-loader 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-46496

    HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs i…

    haxtheweb haxcms-nodejs video-player @haxtheweb/haxcms-nodejs npm
  • Critical 9.3
    CVE-2026-46396

    HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `sr…

    haxtheweb haxcms-nodejs video-player iframe-loader npm
  • Critical 9.3
    CVE-2026-46395 Public exploit

    HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker …

    haxtheweb haxcms-nodejs @haxtheweb/haxcms-nodejs npm
  • Critical 9.4
    CVE-2026-46399

    Authenticated Remote Code Execution via File Overwrite

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands an…

    haxtheweb haxcms-php haxcms-nodejs
  • Critical 9.3
    CVE-2025-54127

    HAXcms's Insecure Default Configuration Leads to Unauthenticated Access

    HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not…

    haxtheweb issues @haxtheweb/haxcms-nodejs npm
  • Critical 10.0
    CVE-2025-32028

    HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution

    HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being…

    haxtheweb issues