Skip to content
OpenAdvisories

Product · haxtheweb

@haxtheweb/open-apis

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.7
    CVE-2026-46391 Public exploit

    HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be…

    haxtheweb @haxtheweb/open-apis @haxtheweb/open-apis npm