GCVE - cpe:2.3:a:haxtheweb:haxcms-php:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:haxtheweb:haxcms-php:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Haxtheweb (`0de9840f-d837-5e08-a211-1a6ecda766ab`)
Product	Haxcms Php (`e46aa3df-16f8-5ee6-a7b0-a481e27a5b2f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/haxtheweb/haxcms-php`	purl2cpe	2026-06-01 10:12:19.734038

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-46399`	vulnerable	2026-07-29 00:54:58.882458	Authenticated Remote Code Execution via File Overwrite HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and achieve code execution on the HAX CMS server. Version 26.0.0 patches the issue. Published: 2026-06-05T18:13:15.808Z Updated: 2026-06-08T16:17:13.761Z Open on db.gcve.eu Reference links https://github.com/haxtheweb/issues/security/advisories/GHSA-q759-vxg8-vq5j	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-46390`	vulnerable	2026-07-29 00:54:58.872063	HAX CMS has Unauthenticated Git Access via User-Controlled Key HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue. Published: 2026-06-05T18:16:17.100Z Updated: 2026-06-09T14:36:33.637Z Open on db.gcve.eu Reference links https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-48527`	vulnerable	2026-06-08 08:05:12.288215	HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint HIGH (8.7) HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue. Published: 2026-05-29T12:26:07.972Z Updated: 2026-05-29T13:02:50.194Z Open on db.gcve.eu Reference links https://github.com/haxtheweb/issues/security/advisories/GHSA-g2g8-95qg-v35h	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-46511`	vulnerable	2026-06-08 08:05:12.094319	HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover. The API dynamically leaks the active session's authentication tokens (including the `jwt`, `user_token`, `site_token`, and `appstore_token`) into a global JavaScript variable (`window.appSettings`). An attacker can exploit the XSS vulnerability to force a victim's browser to silently fetch their specific connection settings, extract the tokens, and exfiltrate them to an attacker-controlled webhook. Version 26.0.0 patches the issue. Published: 2026-06-05T18:32:55.498Z Updated: 2026-06-08T15:55:20.156Z Open on db.gcve.eu Reference links https://github.com/haxtheweb/issues/security/advisories/GHSA-x3x5-7h4h-gwxg	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-46493`	vulnerable	2026-06-08 08:05:12.088991	haxtheweb/haxcms-php uses insecure method for generating salt HIGH (7.5) HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 26.0.1 fixes the issue. Published: 2026-06-05T19:19:37.594Z Updated: 2026-06-05T19:42:36.270Z Open on db.gcve.eu Reference links https://github.com/haxtheweb/issues/security/advisories/GHSA-xg43-xm47-74cp https://github.com/haxtheweb/haxcms-php/commit/4b83cbdf8782c75bdcdd4f57ba72fba1c6dac147 https://github.com/haxtheweb/haxcms-php/blob/8b8845b16e521a326929471e16903f60c6638e8f/install.php#L188-L191	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-46400`	vulnerable	2026-06-08 08:05:12.071643	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-46398`	vulnerable	2026-06-08 08:05:12.071441	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-46397`	vulnerable	2026-06-08 08:05:12.071033	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-46394`	vulnerable	2026-06-08 08:05:12.064212	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-46393`	vulnerable	2026-06-08 08:05:12.064046	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-46392`	vulnerable	2026-06-08 08:05:12.063674	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.