haxtheweb haxcms-php vulnerabilities

Newest CVEs

• CVE-2026-46493

  haxtheweb/haxcms-php uses insecure method for generating salt

  haxtheweb · haxcms-php

  High7.5
• CVE-2026-46400

  HAXCMS PHP has a File Upload Validation Bypass

  haxtheweb · haxcms-php

  High8.7
• CVE-2026-46398

  HAX CMS Missing Secure Flag on Cookie

  haxtheweb · haxcms-php

  High8.8
• CVE-2026-46397

  haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0

  haxtheweb · haxcms-php

  Medium6.5
• CVE-2026-46511

  HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

  haxtheweb · haxcms-nodejs

  High8.7
• CVE-2026-46394

  HAX CMS Vulnerable to Command Injection using Git.php

  haxtheweb · haxcms-php

  High7.7
• CVE-2026-46393

  HAXcms createSite SSRF Enables Arbitrary File Read

  haxtheweb · haxcms-nodejs

  High7.1
• CVE-2026-46392

  HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation

  haxtheweb · haxcms-php

  High8.7
• CVE-2026-46390

  HAX CMS has Unauthenticated Git Access via User-Controlled Key

  haxtheweb · haxcms-php

  Medium6.9
• CVE-2026-46399

  Authenticated Remote Code Execution via File Overwrite

  haxtheweb · haxcms-nodejs

  Critical9.4