CVE-2025-54128

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy CSP. This configuration is insecure for a production application because it does not protect against...

CVE-2025-54128

CVE-2025-54128 affects the NodeJS version of HAX CMS. In versions ≤11.0.7, CSP is disabled in the Helmet config (app.js), creating vulnerability to cross-site scripting. The issue is fixed in version 11.0.8. Affected project: HAX CMS NodeJS; root cause: explicit CSP disablement. Impact statements...