Skip to content
OpenAdvisories

Product · haxtheweb

haxcms-nodejs

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-46496

    HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs i…

    haxtheweb haxcms-nodejs video-player @haxtheweb/haxcms-nodejs npm
  • Critical 9.3
    CVE-2026-46396

    HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `sr…

    haxtheweb haxcms-nodejs video-player iframe-loader npm
  • Critical 9.3
    CVE-2026-46395 Public exploit

    HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker …

    haxtheweb haxcms-nodejs @haxtheweb/haxcms-nodejs npm
  • Critical 9.4
    CVE-2026-46399

    Authenticated Remote Code Execution via File Overwrite

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands an…

    haxtheweb haxcms-php haxcms-nodejs