Security
فارسی
All products

@haxtheweb/haxcms-nodejs

npm · Package
16 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeoverCVE-2026-46396 · GHSA-JH3H-RPXG-FR36 @haxtheweb/haxcms-nodejs@haxtheweb/iframe-loader npm High Fix reported
HAX CMS: Denial of Service using Malicious Import RequestCVE-2026-46357 · GHSA-9R33-XHW8-4QQP @haxtheweb/haxcms-nodejs npm Medium Fix reported
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theftCVE-2026-46496 · GHSA-2M6P-HM3W-6JM3 @haxtheweb/haxcms-nodejs@haxtheweb/video-player npm Medium Fix reported
HAXcms createSite SSRF Enables Arbitrary File ReadCVE-2026-46393 · GHSA-Q862-GCGQ-5M6G @haxtheweb/haxcms-nodejs npm High Fix reported
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack CVE-2026-46511 · GHSA-X3X5-7H4H-GWXG @haxtheweb/haxcms-nodejs npm High Fix reported
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpointCVE-2026-48527 · GHSA-G2G8-95QG-V35H @haxtheweb/haxcms-nodejs npm High Fix reported
HAXcms: Private Key Disclosure via Broken HMAC ImplementationCVE-2026-46395 · GHSA-6C8G-9HFH-PQ5H @haxtheweb/haxcms-nodejs npm Critical Fix reported
HAX CMS API Lacks Authorization ChecksCVE-2025-54378 · GHSA-9JR9-8FF3-M894 elmsln/haxcms@haxtheweb/haxcms-nodejs Composernpm High Fix reported
HAX CMS application pages vulnerable to clickjackingCVE-2025-54139 · GHSA-54VW-F4XF-F92J elmsln/haxcms@haxtheweb/haxcms-nodejs Composernpm Medium Fix reported
HaxCMS-PHP Command Injection VulnerabilityCVE-2025-49141 · GHSA-G4CF-PP4X-HQGW @haxtheweb/haxcms-nodejs npm High Fix reported
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerabilityCVE-2025-49139 · GHSA-V3PH-2Q5Q-CG88 @haxtheweb/haxcms-nodejs npm Medium Fix reported
HAXcms Has Stored XSS Vulnerability that May Lead to Account TakeoverCVE-2026-22704 · GHSA-3FM2-XFQ7-7778 @haxtheweb/haxcms-nodejs npm High Fix reported
NodeJS version of the HAX CMS application is distributed with Default SecretsCVE-2025-54137 · GHSA-5FPV-5QVH-7CF3 @haxtheweb/haxcms-nodejs npm High Fix reported
HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of ServiceCVE-2025-54134 · GHSA-PJJ3-J5J6-QJ27 @haxtheweb/haxcms-nodejs npm High Fix reported
NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site ScriptingCVE-2025-54128 · GHSA-59G8-H59F-8HJP @haxtheweb/haxcms-nodejs npm High Fix reported
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated AccessCVE-2025-54127 · GHSA-F38F-JVQJ-MFG6 @haxtheweb/haxcms-nodejs npm Critical Fix reported