haxtheweb issues

• CVE-2026-46401 Medium 5.3 HAX CMS PHP has Insufficient Session Expiration 0.3%
• CVE-2026-22704 High 8.1 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover 1.0%
• CVE-2025-54378 High 8.3 HAX CMS Backend Lacks Comprehensive Authorization Checks 0.6%
• CVE-2025-54139 Medium 4.3 HAX CMS' application pages are vulnerable to clickjacking 0.4%
• CVE-2025-54137 High 7.3 NodeJS version of the HAX CMS application is distributed with Default Secrets 0.4%
• CVE-2025-54134 High 7.1 HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service 0.5%
• CVE-2025-54129 Medium 4.3 HAXiam allows for User Enumeration 0.3%
• CVE-2025-54128 High 7.2 HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting 0.2%
• CVE-2025-54127 Critical 9.3 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access 0.5%
• CVE-2025-53642 Medium 4.8 haxcms-nodejs and haxcms-php Improperly Terminate Sessions 0.2%
• CVE-2025-49141 High 8.6 HaxCMS-PHP Command Injection Vulnerability 1.6%
• CVE-2025-49139 Medium 5.3 @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability 0.4%
• CVE-2025-49138 Medium 6.5 HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter 0.5%
• CVE-2025-49137 High 8.5 Hax CMS Stored Cross-Site Scripting vulnerability 0.3%
• CVE-2025-48996 Medium 5.3 Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint 0.4%
• CVE-2025-32028 Critical 10.0 HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution 2.0%