CVE-2026-46396

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting XSS vulnerability exists in versions prior to 26.0.0 due to improper sanitization of "" elements. The application allows "javascript:" URIs in the "src" attribute, which are executed when a maliciou...