HAX CMS EUVD-2026-34896

Exploitation requires that the HAX CMS instance is running haxcms-php prior to 26.0.1 and that the attacker can obtain or interact with an artifact derived from the weak salt - typically a password hash, session token, or other value seeded by uniqid() during install - plus a reasonable estimate of when the install ran to constrain the timestamp search space. Limiting factors: the CVSS vector reports C:H/I:N/A:N, so exploitation does not directly yield code execution or data modification; effective attacks generally chain salt prediction with separate access to hashes or tokens, and instances installed long ago with unknown timing or already-rotated secrets are substantially harder to exploit.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) reflects a network-reachable, unauthenticated confidentiality-only impact, consistent with an attacker recovering or predicting salts to enable downstream credential or token attacks rather than direct code execution. EPSS and KEV data were not provided in the input; absent KEV listing, this should be treated as no public exploit identified at time of analysis, and the practical risk depends on whether the predicted salts protect easily targetable assets (e.g., admin password hashes) and on attacker knowledge of install time. The high CVSS confidentiality rating may overstate real-world urgency for installations that are not internet-exposed or that have already rotated credentials since install, but for public HAX CMS instances installed at a known time the predictability is genuinely exploitable and warrants prompt patching.

An attacker who can estimate the approximate installation timestamp of a public HAX CMS site (from HTTP headers, archive.org, or initial-commit metadata) enumerates the narrow set of microsecond values uniqid() could have produced at that time and reconstructs the salt. With the salt known, the attacker accelerates offline cracking of leaked or exposed password hashes, or forges/predicts any other security tokens derived from the same salt, leading to high-impact confidentiality loss against site credentials.