Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

issues — Vulnerabilities & Security Advisories 19

All 19 CVE vulnerabilities found in issues, with AI-generated Chinese analysis, references, and POCs.

This page presents a vulnerability aggregation report for the issues product, categorizing findings by vendor, product, weakness type, and associated tags. It collects detailed records of security vulnerabilities affecting this specific software component, covering incidents reported and updated between January 2022 and December 2023. By organizing these entries into a unified view, the resource enables security professionals and developers to efficiently track a vendor’s advisory history, understand the prevalence and impact of specific weakness classes within this codebase, and look up a product’s comprehensive vulnerability timeline. This structured approach supports informed decision-making regarding patch management, risk assessment, and remediation strategies without requiring manual cross-referencing of disparate sources. Users can filter results based on severity, release date, or common weakness enumerations to isolate critical threats or historical trends. The data aims to provide transparency into how this product has been impacted by known flaws over the specified period, helping teams prioritize fixes and maintain security hygiene. All information is derived from public advisories and tracked through systematic analysis of reported incidents. The goal is to offer a clear, accessible snapshot of the security posture of the issues product, facilitating faster response times and better understanding of recurring vulnerability patterns. This aggregation serves as a reference point for auditing, compliance checks, and technical discussions regarding software integrity.

Vendor: wixtoolset

CVE IDTitleCVSSSeverityPublished
CVE-2026-46401 HAX CMS PHP has Insufficient Session Expiration CWE-613--2026-06-05
CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover CWE-79 8.1 High2026-01-10
CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks CWE-285 8.3 High2025-07-26
CVE-2025-54139 HAX CMS' application pages are vulnerable to clickjacking CWE-1021 4.3 Medium2025-07-22
CVE-2025-54137 NodeJS version of the HAX CMS application is distributed with Default Secrets CWE-1392 7.3 High2025-07-22
CVE-2025-54134 HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service CWE-20 6.5 -2025-07-21
CVE-2025-54129 HAXiam allows for User Enumeration CWE-204 4.3 Medium2025-07-21
CVE-2025-54128 HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting CWE-79 6.1 -2025-07-21
CVE-2025-54127 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access CWE-1188 7.1 -2025-07-21
CVE-2025-53642 haxcms-nodejs and haxcms-php Improperly Terminate Sessions CWE-613 4.8 Medium2025-07-11
CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability CWE-78 8.6 High2025-06-09
CVE-2025-49139 @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability CWE-1021 5.3 Medium2025-06-09
CVE-2025-49138 HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter CWE-22 6.5 Medium2025-06-09
CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability CWE-79 8.5 High2025-06-09
CVE-2025-48996 Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint CWE-201 5.3 Medium2025-06-02
CVE-2025-32028 HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution CWE-434 10.0 Critical2025-04-08
CVE-2024-29188 Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files CWE-59 7.8 High2024-03-24
CVE-2024-29187 WiX based installers are vulnerable to binary hijack when run as SYSTEM CWE-732 7.3 High2024-03-24
CVE-2024-24810 WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges CWE-426 8.3 High2024-02-07

All 19 known CVE vulnerabilities affecting issues with full Chinese analysis, references, and POCs where available.