Skip to content
OpenAdvisories

Product · haxtheweb

haxcms-nodejs

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2026-46511

    HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a …

    haxtheweb haxcms-php haxcms-nodejs @haxtheweb/haxcms-nodejs npm
  • High 7.1
    CVE-2026-46393

    HAXcms createSite SSRF Enables Arbitrary File Read

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the response…

    haxtheweb haxcms-php haxcms-nodejs @haxtheweb/haxcms-nodejs npm
  • High 8.7
    CVE-2026-48527

    HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit …

    haxtheweb haxcms-php haxcms-nodejs @haxtheweb/haxcms-nodejs npm