CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0...

CVE-2026-22704

HAX CMS (HAX) has a stored XSS vulnerability affecting versions 11.0.6 up to, but not including, 25.0.0. The issue can lead to account takeover by injecting malicious HTML/JavaScript via uploaded content, with the Red Hat/ENISAOSV/NVD entries and Snyk advisory corroborating the stored XSS path an...

CVE-2026-22704 haxcms-php 11.0.6 Stored XSS Leading to Account Takeover

HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0...

HAX 跨站脚本漏洞

HAX is HAX The Web open source a HAX + CMS using PHP back-end management of the microsite. A cross-site scripting vulnerability exists in HAX versions 11.0.6 through prior to 25.0.0. The vulnerability stems from the presence of stored cross-site scripting, which could lead to account takeover...

PT-2026-2254

Name of the Vulnerable Software and Affected Versions HAX CMS versions 11.0.6 through 24.x HAX CMS versions prior to 25.0.0 Description HAX CMS, which manages microsite universes with PHP or NodeJs backends, is subject to a stored cross-site scripting XSS issue. This flaw potentially allows for...

EUVD-2025-16686

Malicious code in bioql PyPI...

EUVD-2025-17578

Malicious code in bioql PyPI...

EUVD-2025-22766

Malicious code in bioql PyPI...

EUVD-2025-22388

Malicious code in bioql PyPI...

EUVD-2025-22383

Malicious code in bioql PyPI...

EUVD-2025-22265

Malicious code in bioql PyPI...

EUVD-2025-17563

Malicious code in bioql PyPI...

EUVD-2025-17561

Malicious code in bioql PyPI...

EUVD-2025-17562

Malicious code in bioql PyPI...

EUVD-2025-10386

Malicious code in bioql PyPI...

CVE-2025-54378

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS...

CVE-2025-54378

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS...

CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS...

CVE-2025-54378

CVE-2025-54378 affects HAX CMS backends (nodejs and PHP). The issue is that API endpoints do not verify authorization for resource interactions, only checking authentication, allowing an authenticated user to perform privileged operations. Affected versions: haxcms-nodejs ≤ 11.0.13 and haxcms-php...

CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS...