Skip to content
OpenAdvisories

Vendor

haxtheweb

33 known vulnerabilities.

Products

issues 16 haxcms-php 11 haxcms-nodejs 9 video-player 2 HAXiam 1 @haxtheweb/open-apis 1 iframe-loader 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-46395 Public exploit

    HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker …

    haxtheweb haxcms-nodejs @haxtheweb/haxcms-nodejs npm
  • High 7.7
    CVE-2026-46394 Public exploit

    HAX CMS Vulnerable to Command Injection using Git.php

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vulnerability exists in the Git.php library of the HAXcms PHP backend. The application constructs shell command strings using unsanitized inp…

    haxtheweb haxcms-php
  • High 8.7
    CVE-2026-46391 Public exploit

    HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be…

    haxtheweb @haxtheweb/open-apis @haxtheweb/open-apis npm
  • High 8.1
    CVE-2026-22704 Public exploit

    HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.

    haxtheweb issues @haxtheweb/haxcms-nodejs npm