CVE-2026-22704

🗓️ 10 Jan 2026 06:22:45Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 19 Views🌐 WEB

HAX CMS stored XSS allows account takeover in versions 11.0.6 to before 25.0.0; fixed in 25.0.0.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-46392	5 Jun 202618:20	–	attackerkb
Circl	CVE-2026-22704	9 Jan 202618:45	–	circl
CNNVD	HAX 跨站脚本漏洞	10 Jan 202600:00	–	cnnvd
Cvelist	CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover	10 Jan 202606:22	–	cvelist
Exploit DB	HAX CMS 24.x - Stored Cross-Site Scripting (XSS)	29 Apr 202600:00	–	exploitdb
EUVD	EUVD-2026-1866	13 Jan 202615:07	–	euvd
EUVD	EUVD-2026-34883	5 Jun 202618:20	–	euvd
Github Security Blog	HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover	13 Jan 202615:07	–	github
NVD	CVE-2026-22704	10 Jan 202607:16	–	nvd
OSV	CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover	10 Jan 202606:22	–	osv

NVD

Vulners

Node

psu haxcms-nodejsMatch11.0.6node.js

[
  {
    "vendor": "haxtheweb",
    "product": "issues",
    "versions": [
      {
        "version": ">= 11.0.6, < 25.0.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778
github	www.github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0
github	www.github.com/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e

Parameter	Position	Path	Description	CWE
files[upload]	binary	files/upload	HTML file upload endpoint used to store XSS payloads (stored XSS via uploaded HTML).	CWE-79
filename	path	sites/default/files/{filename}	Stored XSS becomes active when the uploaded HTML file is rendered by other users from the file URL.	CWE-79

17 Jun 2026 10:20Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.4 - 8

EPSS0.01036

SSVC

CWE-79