Haxtheweb
Monthly
Weak cryptographic salt generation in HAX CMS (haxcms-php) versions prior to 26.0.1 allows remote unauthenticated attackers to predict or recover salt values used during installation and authentication-related operations. The flaw stems from using PHP's uniqid() - a timestamp-based, non-cryptographic function - as a randomness source (CWE-338). No public exploit has been identified at time of analysis and the CVE is not on CISA KEV.
Arbitrary file upload in HAX CMS (PHP backend) versions 11.0.6 through 24.x allows authenticated remote attackers to upload PHP webshells disguised as images by abusing a regex-only extension check that ignores MIME type and content inspection, leading to remote code execution on the web server. CVSS v4.0 scores this 8.7 (High) with PR:L indicating low-privilege authentication is required, and no public exploit was identified at time of analysis although the underlying CWE-434 pattern is highly automatable.
Session token disclosure in HAX CMS versions 25.0.0 through 26.0.0 (exclusive) stems from the haxcms_refresh_token cookie being issued without the Secure flag, allowing the browser to send it over plaintext HTTP. A network-positioned attacker can capture the refresh token via passive sniffing and hijack the victim's authenticated session. No public exploit identified at time of analysis, and the vendor has published a fix in version 26.0.0.
OS command injection in HAX CMS (haxtheweb/haxcms-php) prior to version 26.0.0 allows authenticated remote attackers to execute arbitrary commands as the web server user via Git operations in the PHP backend. The Git.php library passes unsanitized input into proc_open() across 16 of 17 shell-invoking functions, with only commit() correctly using escapeshellarg(). No public exploit identified at time of analysis, though the vendor advisory describes a clear chain to full RCE when combined with configuration manipulation.
Stored cross-site scripting in HAX CMS PHP before 26.0.0 lets authenticated low-privilege users upload HTML files with uppercase extensions (.HTML, .Html, .HTM) that bypass the case-sensitive .htaccess Content-Disposition: attachment rule, causing browsers to render the file inline and execute embedded JavaScript in the HAXcms origin. The flaw defeats the mitigation shipped for CVE-2026-22704 and carries a CVSS 8.7 score driven by scope change (S:C) into the victim browser context. No public exploit identified at time of analysis, though the GitHub Security Advisory describes the bypass technique in enough detail to reproduce.
Authenticated remote code execution affects HAX CMS PHP backend versions prior to 26.0.0, where attackers with valid credentials can configure malicious Git filter commands to overwrite files and execute arbitrary code on the server. The flaw carries a CVSS 4.0 score of 9.4 due to full compromise of confidentiality, integrity, and availability with cascading subsequent system impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in HAX CMS (haxcms-nodejs and haxcms-php) through version 26.0.0 allows authenticated page editors to bypass the HTML sanitizer via the /system/api/saveNode endpoint by omitting whitespace before an event handler attribute name. Successful exploitation executes attacker-controlled JavaScript in the browsers of other users viewing the affected microsite, with scope change enabling impact beyond the attacker's own privilege level. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in HAX CMS/HAXiam prior to 25.0.0 exposes authentication tokens, user activity logs, client IP addresses, and server configuration through a publicly accessible /server-status endpoint requiring no authentication. Remote unauthenticated attackers can harvest active session tokens and infrastructure details to facilitate credential theft and reconnaissance. EPSS score of 0.06% (19th percentile) suggests limited observed exploitation attempts, with no CISA KEV listing or public exploit identified at time of analysis.
Persistent session token access in HAX CMS (haxtheweb) prior to version 26.0.0 allows attackers who possess a valid authentication token to retain access to CMS administrative functions and metadata even after the legitimate user has logged out. The root cause is CWE-613 (Insufficient Session Expiration): authentication tokens are not invalidated server-side upon logout, meaning the session termination mechanism is cosmetic rather than functional. Both PHP and NodeJS backend deployments are affected. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the fix is available in version 26.0.0.
Local File Inclusion in HAX CMS's saveOutline endpoint allows an authenticated low-privileged user to read arbitrary files on the server by injecting path traversal sequences into the location field written to site.json. Both the PHP and NodeJS backend variants (haxtheweb/haxcms-php and haxtheweb/haxcms-nodejs) are affected across all versions prior to 26.0.0. There is no public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the confidentiality impact is rated High given that exfiltrable targets include /etc/passwd, application secrets, and web-server-readable configuration files.
Unauthenticated repository exposure in HAX CMS PHP (versions 2.0.0 through 25.x) allows any remote attacker to browse git repositories and full commit history via the unprotected gitlist plugin. The CVSS 4.0 vector confirms no authentication, no user interaction, and network-level access with low complexity, making exploitation trivially achievable against any public-facing instance. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the absence of access controls on the gitlist endpoint represents a direct confidentiality risk for any sensitive data stored in or committed to those repositories.
Weak cryptographic salt generation in HAX CMS (haxcms-php) versions prior to 26.0.1 allows remote unauthenticated attackers to predict or recover salt values used during installation and authentication-related operations. The flaw stems from using PHP's uniqid() - a timestamp-based, non-cryptographic function - as a randomness source (CWE-338). No public exploit has been identified at time of analysis and the CVE is not on CISA KEV.
Arbitrary file upload in HAX CMS (PHP backend) versions 11.0.6 through 24.x allows authenticated remote attackers to upload PHP webshells disguised as images by abusing a regex-only extension check that ignores MIME type and content inspection, leading to remote code execution on the web server. CVSS v4.0 scores this 8.7 (High) with PR:L indicating low-privilege authentication is required, and no public exploit was identified at time of analysis although the underlying CWE-434 pattern is highly automatable.
Session token disclosure in HAX CMS versions 25.0.0 through 26.0.0 (exclusive) stems from the haxcms_refresh_token cookie being issued without the Secure flag, allowing the browser to send it over plaintext HTTP. A network-positioned attacker can capture the refresh token via passive sniffing and hijack the victim's authenticated session. No public exploit identified at time of analysis, and the vendor has published a fix in version 26.0.0.
OS command injection in HAX CMS (haxtheweb/haxcms-php) prior to version 26.0.0 allows authenticated remote attackers to execute arbitrary commands as the web server user via Git operations in the PHP backend. The Git.php library passes unsanitized input into proc_open() across 16 of 17 shell-invoking functions, with only commit() correctly using escapeshellarg(). No public exploit identified at time of analysis, though the vendor advisory describes a clear chain to full RCE when combined with configuration manipulation.
Stored cross-site scripting in HAX CMS PHP before 26.0.0 lets authenticated low-privilege users upload HTML files with uppercase extensions (.HTML, .Html, .HTM) that bypass the case-sensitive .htaccess Content-Disposition: attachment rule, causing browsers to render the file inline and execute embedded JavaScript in the HAXcms origin. The flaw defeats the mitigation shipped for CVE-2026-22704 and carries a CVSS 8.7 score driven by scope change (S:C) into the victim browser context. No public exploit identified at time of analysis, though the GitHub Security Advisory describes the bypass technique in enough detail to reproduce.
Authenticated remote code execution affects HAX CMS PHP backend versions prior to 26.0.0, where attackers with valid credentials can configure malicious Git filter commands to overwrite files and execute arbitrary code on the server. The flaw carries a CVSS 4.0 score of 9.4 due to full compromise of confidentiality, integrity, and availability with cascading subsequent system impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in HAX CMS (haxcms-nodejs and haxcms-php) through version 26.0.0 allows authenticated page editors to bypass the HTML sanitizer via the /system/api/saveNode endpoint by omitting whitespace before an event handler attribute name. Successful exploitation executes attacker-controlled JavaScript in the browsers of other users viewing the affected microsite, with scope change enabling impact beyond the attacker's own privilege level. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in HAX CMS/HAXiam prior to 25.0.0 exposes authentication tokens, user activity logs, client IP addresses, and server configuration through a publicly accessible /server-status endpoint requiring no authentication. Remote unauthenticated attackers can harvest active session tokens and infrastructure details to facilitate credential theft and reconnaissance. EPSS score of 0.06% (19th percentile) suggests limited observed exploitation attempts, with no CISA KEV listing or public exploit identified at time of analysis.
Persistent session token access in HAX CMS (haxtheweb) prior to version 26.0.0 allows attackers who possess a valid authentication token to retain access to CMS administrative functions and metadata even after the legitimate user has logged out. The root cause is CWE-613 (Insufficient Session Expiration): authentication tokens are not invalidated server-side upon logout, meaning the session termination mechanism is cosmetic rather than functional. Both PHP and NodeJS backend deployments are affected. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the fix is available in version 26.0.0.
Local File Inclusion in HAX CMS's saveOutline endpoint allows an authenticated low-privileged user to read arbitrary files on the server by injecting path traversal sequences into the location field written to site.json. Both the PHP and NodeJS backend variants (haxtheweb/haxcms-php and haxtheweb/haxcms-nodejs) are affected across all versions prior to 26.0.0. There is no public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the confidentiality impact is rated High given that exfiltrable targets include /etc/passwd, application secrets, and web-server-readable configuration files.
Unauthenticated repository exposure in HAX CMS PHP (versions 2.0.0 through 25.x) allows any remote attacker to browse git repositories and full commit history via the unprotected gitlist plugin. The CVSS 4.0 vector confirms no authentication, no user interaction, and network-level access with low complexity, making exploitation trivially achievable against any public-facing instance. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the absence of access controls on the gitlist endpoint represents a direct confidentiality risk for any sensitive data stored in or committed to those repositories.