Haxiam
Monthly
Information disclosure in HAX CMS/HAXiam prior to 25.0.0 exposes authentication tokens, user activity logs, client IP addresses, and server configuration through a publicly accessible /server-status endpoint requiring no authentication. Remote unauthenticated attackers can harvest active session tokens and infrastructure details to facilitate credential theft and reconnaissance. EPSS score of 0.06% (19th percentile) suggests limited observed exploitation attempts, with no CISA KEV listing or public exploit identified at time of analysis.
Information disclosure in HAX CMS/HAXiam prior to 25.0.0 exposes authentication tokens, user activity logs, client IP addresses, and server configuration through a publicly accessible /server-status endpoint requiring no authentication. Remote unauthenticated attackers can harvest active session tokens and infrastructure details to facilitate credential theft and reconnaissance. EPSS score of 0.06% (19th percentile) suggests limited observed exploitation attempts, with no CISA KEV listing or public exploit identified at time of analysis.