Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

haxtheweb — Vulnerabilities & Security Advisories 33

Browse all 33 CVE security advisories affecting haxtheweb. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Haxtheweb primarily develops web applications and APIs for enterprise clients, with a core focus on custom business solutions. Historically, the organization has been associated with multiple remote code execution, cross-site scripting, and privilege escalation vulnerabilities across its products. Security assessments reveal consistent flaws in input validation and authentication mechanisms. While no major public breaches have been directly attributed to haxtheweb, its cumulative 16 CVEs indicate systemic security weaknesses in development practices. The organization's codebase frequently demonstrates inadequate sanitization of user inputs and misconfigured access controls, creating persistent exposure vectors for attackers.

Found 16 results / 33 Clear Filters
CVE ID Title CVSS Severity Published
CVE-2026-46401 HAX CMS PHP has Insufficient Session Expiration — issues CWE-613 - - 2026-06-05
CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover — issues CWE-79 8.1 High 2026-01-10
CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks — issues CWE-285 8.3 High 2025-07-26
CVE-2025-54139 HAX CMS' application pages are vulnerable to clickjacking — issues CWE-1021 4.3 Medium 2025-07-22
CVE-2025-54137 NodeJS version of the HAX CMS application is distributed with Default Secrets — issues CWE-1392 7.3 High 2025-07-22
CVE-2025-54134 HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service — issues CWE-20 6.5 - 2025-07-21
CVE-2025-54129 HAXiam allows for User Enumeration — issues CWE-204 4.3 Medium 2025-07-21
CVE-2025-54128 HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting — issues CWE-79 6.1 - 2025-07-21
CVE-2025-54127 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access — issues CWE-1188 7.1 - 2025-07-21
CVE-2025-53642 haxcms-nodejs and haxcms-php Improperly Terminate Sessions — issues CWE-613 4.8 Medium 2025-07-11
CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability — issues CWE-78 8.6 High 2025-06-09
CVE-2025-49139 @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability — issues CWE-1021 5.3 Medium 2025-06-09
CVE-2025-49138 HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter — issues CWE-22 6.5 Medium 2025-06-09
CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability — issues CWE-79 8.5 High 2025-06-09
CVE-2025-48996 Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint — issues CWE-201 5.3 Medium 2025-06-02
CVE-2025-32028 HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution — issues CWE-434 10.0 Critical 2025-04-08

This page lists every published CVE security advisory associated with haxtheweb. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.