Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

haxtheweb — Vulnerabilities & Security Advisories 33

Browse all 33 CVE security advisories affecting haxtheweb. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Haxtheweb primarily develops web applications and APIs for enterprise clients, with a core focus on custom business solutions. Historically, the organization has been associated with multiple remote code execution, cross-site scripting, and privilege escalation vulnerabilities across its products. Security assessments reveal consistent flaws in input validation and authentication mechanisms. While no major public breaches have been directly attributed to haxtheweb, its cumulative 16 CVEs indicate systemic security weaknesses in development practices. The organization's codebase frequently demonstrates inadequate sanitization of user inputs and misconfigured access controls, creating persistent exposure vectors for attackers.

CVE ID Title CVSS Severity Published
CVE-2026-46357 HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request — haxcms-nodejs CWE-20 6.5 Medium 2026-06-05
CVE-2026-46493 haxtheweb/haxcms-php uses insecure method for generating salt — haxcms-php CWE-338 7.5 High 2026-06-05
CVE-2026-46401 HAX CMS PHP has Insufficient Session Expiration — issues CWE-613 - - 2026-06-05
CVE-2026-46400 HAXCMS PHP has a File Upload Validation Bypass — haxcms-php CWE-434 - - 2026-06-05
CVE-2026-46398 HAX CMS Missing Secure Flag on Cookie — haxcms-php CWE-614 - - 2026-06-05
CVE-2026-46397 haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 — haxcms-php CWE-22 6.5 Medium 2026-06-05
CVE-2026-46496 HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft — haxcms-nodejs CWE-79 - - 2026-06-05
CVE-2026-46396 HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover — haxcms-nodejs CWE-79 - - 2026-06-05
CVE-2026-46511 HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack — haxcms-nodejs CWE-79 - - 2026-06-05
CVE-2026-46395 HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation — haxcms-nodejs CWE-200 - - 2026-06-05
CVE-2026-46394 HAX CMS Vulnerable to Command Injection using Git.php — haxcms-php CWE-78 - - 2026-06-05
CVE-2026-46393 HAXcms createSite SSRF Enables Arbitrary File Read — haxcms-nodejs CWE-918 - - 2026-06-05
CVE-2026-46392 HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation — haxcms-php CWE-178 8.7 High 2026-06-05
CVE-2026-46391 HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis — @haxtheweb/open-apis CWE-183 - - 2026-06-05
CVE-2026-46390 HAX CMS has Unauthenticated Git Access via User-Controlled Key — haxcms-php CWE-639 - - 2026-06-05
CVE-2026-46399 Authenticated Remote Code Execution via File Overwrite — haxcms-nodejs CWE-15 - - 2026-06-05
CVE-2026-48527 HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint — haxcms-nodejs CWE-79 8.7 High 2026-05-29
CVE-2026-35185 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses — HAXiam CWE-284 7.5AI High AI 2026-04-06
CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover — issues CWE-79 8.1 High 2026-01-10
CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks — issues CWE-285 8.3 High 2025-07-26
CVE-2025-54139 HAX CMS' application pages are vulnerable to clickjacking — issues CWE-1021 4.3 Medium 2025-07-22
CVE-2025-54137 NodeJS version of the HAX CMS application is distributed with Default Secrets — issues CWE-1392 7.3 High 2025-07-22
CVE-2025-54134 HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service — issues CWE-20 6.5 - 2025-07-21
CVE-2025-54129 HAXiam allows for User Enumeration — issues CWE-204 4.3 Medium 2025-07-21
CVE-2025-54128 HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting — issues CWE-79 6.1 - 2025-07-21
CVE-2025-54127 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access — issues CWE-1188 7.1 - 2025-07-21
CVE-2025-53642 haxcms-nodejs and haxcms-php Improperly Terminate Sessions — issues CWE-613 4.8 Medium 2025-07-11
CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability — issues CWE-78 8.6 High 2025-06-09
CVE-2025-49139 @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability — issues CWE-1021 5.3 Medium 2025-06-09
CVE-2025-49138 HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter — issues CWE-22 6.5 Medium 2025-06-09

This page lists every published CVE security advisory associated with haxtheweb. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.