HIGH8.5Packagist
GHSA-2vc4-3hx7-v7v7· CVE-2025-49137Hax CMS Stored Cross-Site Scripting vulnerability
Modified: 9/10/2026
package
Packagist/elmsln/haxcms
pkg:packagist/elmsln/haxcms
MEDIUM6.5Packagist
GHSA-hxrr-x32w-cg8g· CVE-2025-49138HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter
Modified: 9/10/2026
MEDIUM4.3npmPackagist
GHSA-54vw-f4xf-f92j· CVE-2025-54139HAX CMS application pages vulnerable to clickjacking
Modified: 9/10/2026
HIGH8.3npmPackagist
GHSA-9jr9-8ff3-m894· CVE-2025-54378HAX CMS API Lacks Authorization Checks
Modified: 9/10/2026