haxtheweb haxcms-nodejs vulnerabilities

Newest CVEs

• CVE-2026-46357

  HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request

  haxtheweb · haxcms-nodejs

  Medium6.5
• CVE-2026-46397

  haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0

  haxtheweb · haxcms-php

  Medium6.5
• CVE-2026-46496

  HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

  haxtheweb · haxcms-nodejs

  Critical9.3
• CVE-2026-46396

  HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover

  haxtheweb · haxcms-nodejs

  Critical9.3
• CVE-2026-46511

  HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

  haxtheweb · haxcms-nodejs

  High8.7
• CVE-2026-46395

  HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

  haxtheweb · haxcms-nodejs

  Critical9.3
• CVE-2026-46393

  HAXcms createSite SSRF Enables Arbitrary File Read

  haxtheweb · haxcms-nodejs

  High7.1
• CVE-2026-46399

  Authenticated Remote Code Execution via File Overwrite

  haxtheweb · haxcms-nodejs

  Critical9.4
• CVE-2026-48527

  HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint

  haxtheweb · haxcms-nodejs

  High8.7