What’s Vulnerable › Products
haxtheweb haxcms-nodejs vulnerabilities
20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.
Check whether your haxtheweb haxcms-nodejs version is affected
Latest haxtheweb haxcms-nodejs vulnerabilities
- CVE-2026-46397 — haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 (CVSS 6.5)
- CVE-2026-46357 — HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request (CVSS 6.5)
- CVE-2026-46511 — HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack (CVSS 8.7)
- CVE-2026-46496 — HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft (CVSS 9.3)
- CVE-2026-46399 — Authenticated Remote Code Execution via File Overwrite (CVSS 9.4)
- CVE-2026-46396 — HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover (CVSS 9.3)
- CVE-2026-46395 — HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation (CVSS 9.3)
- CVE-2026-46393 — HAXcms createSite SSRF Enables Arbitrary File Read (CVSS 7.1)
- CVE-2026-48527 — HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint (CVSS 8.7)
- CVE-2026-22704 — HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover (CVSS 5.4)
- CVE-2025-54378 — HAX CMS Backend Lacks Comprehensive Authorization Checks (CVSS 8.3)
- CVE-2025-54139 — HAX CMS' application pages are vulnerable to clickjacking (CVSS 6.1)
- CVE-2025-54137 — NodeJS version of the HAX CMS application is distributed with Default Secrets (CVSS 7.3)
- CVE-2025-54134 — HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service (CVSS 6.5)
- CVE-2025-54128 — HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting (CVSS 6.1)
- CVE-2025-54127 — HAXcms's Insecure Default Configuration Leads to Unauthenticated Access (CVSS 9.8)
- CVE-2025-53642 — haxcms-nodejs and haxcms-php Improperly Terminate Sessions (CVSS 6.5)
- CVE-2025-49141 — HaxCMS-PHP Command Injection Vulnerability (CVSS 8.8)
- CVE-2025-49139 — @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability (CVSS 6.5)
- CVE-2025-49137 — Hax CMS Stored Cross-Site Scripting vulnerability (CVSS 6.1)