What’s Vulnerable › Products

haxtheweb haxcms-php vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your haxtheweb haxcms-php version is affected

Latest haxtheweb haxcms-php vulnerabilities

• CVE-2026-46493 — haxtheweb/haxcms-php uses insecure method for generating salt (CVSS 7.5)
• CVE-2026-46400 — HAXCMS PHP has a File Upload Validation Bypass (CVSS 8.7)
• CVE-2026-46398 — HAX CMS Missing Secure Flag on Cookie (CVSS 8.8)
• CVE-2026-46397 — haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 (CVSS 6.5)
• CVE-2026-46511 — HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack (CVSS 8.7)
• CVE-2026-46399 — Authenticated Remote Code Execution via File Overwrite (CVSS 9.4)
• CVE-2026-46394 — HAX CMS Vulnerable to Command Injection using Git.php (CVSS 7.7)
• CVE-2026-46393 — HAXcms createSite SSRF Enables Arbitrary File Read (CVSS 7.1)
• CVE-2026-46392 — HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation (CVSS 8.7)
• CVE-2026-46390 — HAX CMS has Unauthenticated Git Access via User-Controlled Key (CVSS 6.9)
• CVE-2026-48527 — HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint (CVSS 8.7)
• CVE-2025-54378 — HAX CMS Backend Lacks Comprehensive Authorization Checks (CVSS 8.3)
• CVE-2025-54139 — HAX CMS' application pages are vulnerable to clickjacking (CVSS 6.1)
• CVE-2025-53642 — haxcms-nodejs and haxcms-php Improperly Terminate Sessions (CVSS 6.5)
• CVE-2025-49141 — HaxCMS-PHP Command Injection Vulnerability (CVSS 8.8)
• CVE-2025-49139 — @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability (CVSS 6.5)
• CVE-2025-49138 — HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter (CVSS 6.5)
• CVE-2025-49137 — Hax CMS Stored Cross-Site Scripting vulnerability (CVSS 6.1)
• CVE-2025-32028 — HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution (CVSS 9.9)