HA
Vendor
haxtheweb
41
CVEs
0
On KEV
0
New 30D
Products
IS9.9
issues
haxtheweb
16 CVEs0 on KEV0 new
HA9.4
haxcms-php
haxtheweb
11 CVEs0 on KEV0 new
HA9.4
haxcms-nodejs
haxtheweb
9 CVEs0 on KEV0 new
VI9.3
video-player
haxtheweb
2 CVEs0 on KEV0 new
HA7.5
HAXiam
haxtheweb
1 CVEs0 on KEV0 new
HA8.7
@haxtheweb/open-apis
haxtheweb
1 CVEs0 on KEV0 new
IF9.3
iframe-loader
haxtheweb
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-46357 | HA haxcms-nodejs haxtheweb | 6.5 | Jun 5 | HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request |
| CVE-2026-46493 | HA haxcms-php haxtheweb | 7.5 | Jun 5 | haxtheweb/haxcms-php uses insecure method for generating salt |
| CVE-2026-46401 | IS issues haxtheweb | 5.3 | Jun 5 | HAX CMS PHP has Insufficient Session Expiration |
| CVE-2026-46400 | HA haxcms-php haxtheweb | 8.7 | Jun 5 | HAXCMS PHP has a File Upload Validation Bypass |
| CVE-2026-46398 | HA haxcms-php haxtheweb | 8.8 | Jun 5 | HAX CMS Missing Secure Flag on Cookie |
| CVE-2026-46397 | HA haxcms-php haxtheweb | 6.5 | Jun 5 | haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 |
| CVE-2026-46496 | HA haxcms-nodejs haxtheweb | 9.3 | Jun 5 | HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft |
| CVE-2026-46396 | VI video-player haxtheweb | 9.3 | Jun 5 | HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover |
| CVE-2026-46511 | HA haxcms-php haxtheweb | 8.7 | Jun 5 | HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack |
| CVE-2026-46395 | HA haxcms-nodejs haxtheweb | 9.3 | Jun 5 | HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation |
| CVE-2026-46394 | HA haxcms-php haxtheweb | 7.7 | Jun 5 | HAX CMS Vulnerable to Command Injection using Git.php |
| CVE-2026-46393 | HA haxcms-php haxtheweb | 7.1 | Jun 5 | HAXcms createSite SSRF Enables Arbitrary File Read |
| CVE-2026-46392 | HA haxcms-php haxtheweb | 8.7 | Jun 5 | HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation |
| CVE-2026-46391 | HA @haxtheweb/open-apis haxtheweb | 8.7 | Jun 5 | HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis |
| CVE-2026-46390 | HA haxcms-php haxtheweb | 6.9 | Jun 5 | HAX CMS has Unauthenticated Git Access via User-Controlled Key |
| CVE-2026-46399 | HA haxcms-nodejs haxtheweb | 9.4 | Jun 5 | Authenticated Remote Code Execution via File Overwrite |
| CVE-2026-48527 | HA haxcms-php haxtheweb | 8.7 | May 29 | HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint |
| CVE-2026-35185 | HA HAXiam haxtheweb | 7.5 | Apr 6 | HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses |
| CVE-2026-22704 | IS issues haxtheweb | 5.4 | Jan 10 | HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover |
| CVE-2025-54378 | IS issues haxtheweb | 8.3 | Jul 26 | HAX CMS Backend Lacks Comprehensive Authorization Checks |
| CVE-2025-54139 | IS issues haxtheweb | 6.1 | Jul 22 | HAX CMS' application pages are vulnerable to clickjacking |
| CVE-2025-54137 | IS issues haxtheweb | 7.3 | Jul 22 | NodeJS version of the HAX CMS application is distributed with Default Secrets |
| CVE-2025-54134 | IS issues haxtheweb | 6.5 | Jul 21 | HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service |
| CVE-2025-54129 | IS issues haxtheweb | 4.3 | Jul 21 | HAXiam allows for User Enumeration |
| CVE-2025-54128 | IS issues haxtheweb | 6.1 | Jul 21 | HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting |
| CVE-2025-54127 | IS issues haxtheweb | 9.8 | Jul 21 | HAXcms's Insecure Default Configuration Leads to Unauthenticated Access |
| CVE-2025-53642 | IS issues haxtheweb | 6.5 | Jul 11 | haxcms-nodejs and haxcms-php Improperly Terminate Sessions |
| CVE-2025-49141 | IS issues haxtheweb | 8.8 | Jun 9 | HaxCMS-PHP Command Injection Vulnerability |
| CVE-2025-49139 | IS issues haxtheweb | 6.5 | Jun 9 | @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability |
| CVE-2025-49138 | IS issues haxtheweb | 6.5 | Jun 9 | HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter |
| CVE-2025-49137 | IS issues haxtheweb | 6.1 | Jun 9 | Hax CMS Stored Cross-Site Scripting vulnerability |
| CVE-2025-48996 | IS issues haxtheweb | 5.3 | Jun 2 | Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint |
| CVE-2025-32028 | IS issues haxtheweb | 9.9 | Apr 8 | HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution |