Skip to content
OpenAdvisories

Product · haxtheweb

haxcms-nodejs

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-46357

    HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is…

    haxtheweb haxcms-nodejs @haxtheweb/haxcms-nodejs npm
  • Medium 6.5
    CVE-2026-46397

    haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by ma…

    haxtheweb haxcms-php haxcms-nodejs