What’s Vulnerable › Products

haxtheweb video-player vulnerabilities

2 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your haxtheweb video-player version is affected

Latest haxtheweb video-player vulnerabilities

• CVE-2026-46496 — HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft (CVSS 9.3)
• CVE-2026-46396 — HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover (CVSS 9.3)