Skip to content
OpenAdvisories

Product · haxtheweb

issues

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-54127

    HAXcms's Insecure Default Configuration Leads to Unauthenticated Access

    HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not…

    haxtheweb issues @haxtheweb/haxcms-nodejs npm
  • Critical 10.0
    CVE-2025-32028

    HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution

    HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being…

    haxtheweb issues