haxtheweb issues vulnerabilities

CVEs per yearBy the year they were published

1. 202514
2. 20262

Newest CVEs

• CVE-2026-46401

  HAX CMS PHP has Insufficient Session Expiration

  haxtheweb · issues

  Medium5.3
• CVE-2026-22704

  HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

  haxtheweb · issues

  High8.1
• CVE-2025-54378

  HAX CMS Backend Lacks Comprehensive Authorization Checks

  haxtheweb · issues

  High8.3
• CVE-2025-54139

  HAX CMS' application pages are vulnerable to clickjacking

  haxtheweb · issues

  Medium4.3
• CVE-2025-54137

  NodeJS version of the HAX CMS application is distributed with Default Secrets

  haxtheweb · issues

  High7.3
• CVE-2025-54134

  HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service

  haxtheweb · issues

  High7.1
• CVE-2025-54129

  HAXiam allows for User Enumeration

  haxtheweb · issues

  Medium4.3
• CVE-2025-54128

  HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting

  haxtheweb · issues

  High7.2
• CVE-2025-54127

  HAXcms's Insecure Default Configuration Leads to Unauthenticated Access

  haxtheweb · issues

  Critical9.3
• CVE-2025-53642

  haxcms-nodejs and haxcms-php Improperly Terminate Sessions

  haxtheweb · issues

  Medium4.8