Skip to content
OpenAdvisories

Product · haxtheweb

haxcms-nodejs

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-46395 Public exploit

    HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker …

    haxtheweb haxcms-nodejs @haxtheweb/haxcms-nodejs npm