@haxtheweb/haxcms-nodejs
npm7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @haxtheweb/haxcms-nodejspage 1 of 1
- CVE-2025-49139MEDIUMCVSS 5.3EG 5.3✓ Fixed in 11.0.02025-06-09
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a t…
- CVE-2025-49141HIGHCVSS 8.5EG 8.5✓ Fixed in 11.0.32025-06-09
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string from a POST request and insufficiently validates user input. The `set_remote` f…
- CVE-2025-54127CRITICALCVSS 9.8EG 9.8✓ Fixed in 11.0.72025-07-21
HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default co…
- CVE-2025-54134MEDIUMCVSS 6.5EG 6.5✓ Fixed in 11.0.92025-07-21
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL paramete…
- CVE-2025-54137HIGHCVSS 7.3EG 7.3✓ Fixed in 11.0.102025-07-22
HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has defa…
- CVE-2025-54139MEDIUMCVSS 4.3EG 4.3✓ Fixed in 11.0.132025-07-23
HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers …
- CVE-2025-54378HIGHCVSS 8.3EG 8.3✓ Fixed in 11.0.142025-07-26
HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interactin…
Check whether @haxtheweb/haxcms-nodejs is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @haxtheweb/haxcms-nodejs CVEs against the assets you own.
Start Free Scan →