npm/@haxtheweb/haxcms-nodejs

HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

Modified: 9/10/2026

HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

Modified: 2/3/2026

HAX CMS application pages vulnerable to clickjacking

Modified: 9/10/2026

NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting

Modified: 7/21/2025

NodeJS version of the HAX CMS application is distributed with Default Secrets

Modified: 7/23/2025

HAXcms: Private Key Disclosure via Broken HMAC Implementation

Modified: 9/10/2026

HAX CMS API Lacks Authorization Checks

Modified: 9/10/2026

HAX CMS: Denial of Service using Malicious Import Request

Modified: 9/10/2026

NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access

Modified: 7/21/2025

HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint

Modified: 9/10/2026

HaxCMS-PHP Command Injection Vulnerability

Modified: 9/10/2026

Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover

Modified: 9/10/2026

HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service

Modified: 7/21/2025

HAXcms createSite SSRF Enables Arbitrary File Read

Modified: 9/10/2026

@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability

Modified: 9/10/2026

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

Modified: 9/10/2026