haxtheweb vulnerabilities

CVEs per yearBy the year they were published

1. 202514
2. 202619

Newest CVEs

• CVE-2026-46357

  HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request

  haxtheweb · haxcms-nodejs

  Medium6.5
• CVE-2026-46493

  haxtheweb/haxcms-php uses insecure method for generating salt

  haxtheweb · haxcms-php

  High7.5
• CVE-2026-46401

  HAX CMS PHP has Insufficient Session Expiration

  haxtheweb · issues

  Medium5.3
• CVE-2026-46400

  HAXCMS PHP has a File Upload Validation Bypass

  haxtheweb · haxcms-php

  High8.7
• CVE-2026-46398

  HAX CMS Missing Secure Flag on Cookie

  haxtheweb · haxcms-php

  High8.8
• CVE-2026-46397

  haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0

  haxtheweb · haxcms-php

  Medium6.5
• CVE-2026-46496

  HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

  haxtheweb · haxcms-nodejs

  Critical9.3
• CVE-2026-46396

  HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover

  haxtheweb · haxcms-nodejs

  Critical9.3
• CVE-2026-46511

  HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

  haxtheweb · haxcms-nodejs

  High8.7
• CVE-2026-46395

  HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

  haxtheweb · haxcms-nodejs

  Critical9.3