Haxtheweb vulnerabilities
We track 19 vulnerabilities in Haxtheweb products across 7 products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on June 5, 2026.
Latest Haxtheweb vulnerabilities
- 7.5 High severity
haxcms-php: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.
- 8.7 High severity
haxcms-php: Unrestricted Upload of File with Dangerous Type
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.0.0, the file upload functionality in HAXCMS PHP only validates file extensions using a regex pattern without checking the actual file conte
- 8.8 High severity
haxcms-php: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted HTTP, making it vulne
- 8.7 High severity
haxcms-nodejs: Improper Neutralization of Input During Web Page Generation
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a c
- 9.3 Critical severity
haxcms-nodejs: Improper Neutralization of Input During Web Page Generation
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs in
- 9.4 Critical severity
haxcms-nodejs: External Control of System or Configuration Setting
HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and
- 9.3 Critical severity
haxcms-nodejs: Improper Neutralization of Input During Web Page Generation
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src
- 9.3 Critical severity
haxcms-nodejs: Exposure of Sensitive Information to an Unauthorized Actor
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker t
- 7.7 High severity
haxcms-php: Improper Neutralization of Special Elements used in an OS Command
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vulnerability exists in the Git.php library of the HAXcms PHP backend. The application constructs shell command strings using unsanitized inpu
- 7.1 High severity
haxcms-nodejs: Server-Side Request Forgery
HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses
- 8.7 High severity
haxcms-php: Improper Handling of Case Sensitivity
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFile` endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the `.htaccess` rule that forces `
- 8.7 High severity
@haxtheweb/open-apis: Permissive List of Allowed Inputs
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be
- 8.7 High severity
haxcms-nodejs: Improper Neutralization of Input During Web Page Generation
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit p
- 7.5 High severity
HAXiam: Insertion of Sensitive Information into Log File
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and ser
- 8.3 High severity
issues: Improper Authorization
HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Bo
- 7.3 High severity
issues: Use of Default Credentials
HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for
- 9.8 Critical severity
issues: Initialization of a Resource with an Insecure Default
HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not
- 8.8 High severity
issues: Improper Neutralization of Special Elements used in an OS Command
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string from a POST request and insufficiently validates user input. The `set_remote` function later passes
- 9.9 Critical severity
issues: Unrestricted Upload of File with Dangerous Type
HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being