Hhaxtheweb

Products

Exploited and recent CVEs

• CVE-2026-46357 Medium 6.5 HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request 0.2%
• CVE-2026-46493 High 7.5 haxtheweb/haxcms-php uses insecure method for generating salt 0.3%
• CVE-2026-46401 Medium 5.3 HAX CMS PHP has Insufficient Session Expiration 0.3%
• CVE-2026-46400 High 8.7 HAXCMS PHP has a File Upload Validation Bypass 0.4%
• CVE-2026-46398 High 8.8 HAX CMS Missing Secure Flag on Cookie 0.2%
• CVE-2026-46397 Medium 6.5 haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 0.3%
• CVE-2026-46397 Medium 6.5 haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 0.3%
• CVE-2026-46496 Critical 9.3 HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft 0.2%
• CVE-2026-46496 Critical 9.3 HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft 0.2%
• CVE-2026-46396 Critical 9.3 HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover 0.2%
• CVE-2026-46396 Critical 9.3 HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover 0.2%
• CVE-2026-46396 Critical 9.3 HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover 0.2%
• CVE-2026-46511 High 8.7 HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack 0.3%
• CVE-2026-46511 High 8.7 HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack 0.3%
• CVE-2026-46395 Critical 9.3 HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation 0.3%
• CVE-2026-46394 High 7.7 HAX CMS Vulnerable to Command Injection using Git.php 0.8%
• CVE-2026-46393 High 7.1 HAXcms createSite SSRF Enables Arbitrary File Read 0.2%
• CVE-2026-46393 High 7.1 HAXcms createSite SSRF Enables Arbitrary File Read 0.2%
• CVE-2026-46392 High 8.7 HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation 0.3%
• CVE-2026-46391 High 8.7 HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis 0.5%
• CVE-2026-46390 Medium 6.9 HAX CMS has Unauthenticated Git Access via User-Controlled Key 0.3%
• CVE-2026-46399 Critical 9.4 Authenticated Remote Code Execution via File Overwrite 0.3%
• CVE-2026-46399 Critical 9.4 Authenticated Remote Code Execution via File Overwrite 0.3%
• CVE-2026-48527 High 8.7 HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint 0.2%
• CVE-2026-48527 High 8.7 HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint 0.2%
• CVE-2026-35185 High 8.7 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses 0.4%
• CVE-2026-22704 High 8.1 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover 1.0%
• CVE-2025-54378 High 8.3 HAX CMS Backend Lacks Comprehensive Authorization Checks 0.6%
• CVE-2025-54139 Medium 4.3 HAX CMS' application pages are vulnerable to clickjacking 0.4%
• CVE-2025-54137 High 7.3 NodeJS version of the HAX CMS application is distributed with Default Secrets 0.4%