Server-side Request Forgery (SSRF)

Overview @haxtheweb/haxcms-nodejs is a HAXcms nodejs backend Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the createSite function. An attacker can access internal network resources and read arbitrary files by supplying crafted URLs or file paths to the...

@haxtheweb/create (>=25.0.2, <=26.0.0), @haxtheweb/open-apis (>=25.0.0, <=26.0.0) potentially affected by CVE-2026-46393 via @haxtheweb/haxcms-nodejs (25.0.0)

@haxtheweb/haxcms-nodejs NPM version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/haxcms-nodejs and may be impacted: - @haxtheweb/create =25.0.2, =25.0.0, =26.0.0 Source cves: CVE-2026-46393 Source advisory: GHSA-Q862-GCGQ-5M6G...

PT-2026-41975

Name of the Vulnerable Software and Affected Versions HAX CMS versions prior to 26.0.0 Description An authenticated Server-Side Request Forgery SSRF allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and...

@haxtheweb/create (>=11.0.3, <=25.0.0), @haxtheweb/open-apis (11.0.3) potentially affected by CVE-2026-22704 via @haxtheweb/haxcms-nodejs (11.0.15)

@haxtheweb/haxcms-nodejs NPM version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/haxcms-nodejs and may be impacted: - @haxtheweb/create =11.0.3, =25.0.0 - @haxtheweb/open-apis 11.0.3 Source cves: CVE-2026-22704 Source advisory:...

@haxtheweb/create (>=11.0.3, <=25.0.0), @haxtheweb/open-apis (11.0.3) potentially affected by CVE-2026-22704 via @haxtheweb/haxcms-nodejs (11.0.15)

@haxtheweb/haxcms-nodejs NPM version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/haxcms-nodejs and may be impacted: - @haxtheweb/create =11.0.3, =25.0.0 - @haxtheweb/open-apis 11.0.3 Source cves: CVE-2026-22704 Source advisory:...

GHSA-3FM2-XFQ7-7778 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

Summary Stored XSS Leading to Account Takeover Details The Exploit Chain: 1.Upload: The attacker uploads an .html file containing a JavaScript payload. 2.Execution: A logged-in administrator is tricked into visiting the URL of this uploaded file. 3.Token Refresh: The JavaScript payload makes a...

@haxtheweb/create (>=11.0.3, <=25.0.0), @haxtheweb/open-apis (11.0.3) potentially affected by CVE-2026-22704 via @haxtheweb/haxcms-nodejs (11.0.15)

@haxtheweb/haxcms-nodejs NPM version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/haxcms-nodejs and may be impacted: - @haxtheweb/create =11.0.3, =25.0.0 - @haxtheweb/open-apis 11.0.3 Source cves: CVE-2026-22704 Source advisory:...

EUVD-2025-22261

Malicious code in bioql PyPI...

EUVD-2025-21181

Malicious code in bioql PyPI...

Improper Authorization

Overview @haxtheweb/haxcms-nodejs is a HAXcms nodejs backend Affected versions of this package are vulnerable to Improper Authorization in the API endpoints, which do not verify user permissions before performing operations. An attacker can gain unauthorized access to resources or perform actions...

CVE-2025-54378: Improper Authorization

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS...

Cross-Site Scripting (XSS)

@haxtheweb/haxcms-nodejs is vulnerable to cross-site scripting. The vulnerability is due to the explicit disabling of the Content Security Policy CSP in the Helmet configuration in app.js, which allows an attacker to inject and execute malicious scripts in the context of the application...

CVE-2025-54127

HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authenticati...

Clickjacking

@haxtheweb/haxcms-nodejs and elmsln/haxcms are vulnerable to Clickjacking. The vulnerability is due to missing anti-framing headers caused by the absence of X-Frame-Options or equivalent headers in both the CMS and generated sites, allowing unauthenticated attackers to embed sensitive pages in...

CVE-2025-54139: Improper Restriction of Rendered UI Layers or Frames

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an...

NodeJS 安全漏洞

NodeJS is a JavaScript runtime environment based on the ChromeV8 engine from the OpenJS Foundation. By encapsulating the Chromev8 engine and using event-driven and non-blocking IO applications make it possible to develop high-performance backend applications in Javascript. A security vulnerabilit...

@haxtheweb/create (>=0.1.3, <=11.0.2), @haxtheweb/open-apis (11.0.2) potentially affected by CVE-2025-54139 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=10.0.6)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2 - @haxtheweb/open-apis 11.0.2 Source cves: CVE-2025-54139 Source advisory: MEND:CVE-2025-54139...

CVE-2025-54139

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an...

@haxtheweb/create (>=0.1.3, <=11.0.2), @haxtheweb/open-apis (11.0.2) potentially affected by CVE-2025-54137 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=10.0.6)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2 - @haxtheweb/open-apis 11.0.2 Source cves: CVE-2025-54137 Source advisory: MEND:CVE-2025-54137...

HAXcms with nodejs backend 安全漏洞

HAXcms with nodejs backend is an open source backend management system from HAX The Web. A security vulnerability exists in HAXcms with nodejs backend version 11.0.9 and earlier, which stems from hardcoding default credentials and JWT private keys, which could lead to unauthorized access...