@haxtheweb/create (>=10.0.0, <=11.0.2), @haxtheweb/open-apis (11.0.2) potentially affected by CVE-2025-48996 via @haxtheweb/open-apis (10.0.1)

@haxtheweb/open-apis NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/open-apis and may be impacted: - @haxtheweb/create =10.0.0, =11.0.2 - @haxtheweb/open-apis 11.0.2 Source cves: CVE-2025-48996 Source advisory:...

CVE-2025-48996

creationtimestamp| type| source ---|---|--- 2025-06-02 20:37:42+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqnmxvlqxrc2 2025-06-03 00:42:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqo2nkdcel2e...

CVE-2025-48996

CVE-2025-48996 describes an unauthenticated information disclosure in HAX open-apis used by PSU deployment of HAX CMS via the haxPsuUsage API endpoint. The vulnerability allows remote, unauthenticated users to enumerate a full list of PSU websites hosted on HAX CMS. The issue is associated with o...

CVE-2025-48996 Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the haxPsuUsage API endpoint, related to a flat...

CVE-2025-48996 Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the haxPsuUsage API endpoint, related to a flat...