MEDIUMnpm
GHSA-2m6p-hm3w-6jm3· CVE-2026-46496HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
Modified: 9/10/2026
package
pkg:npm/%40haxtheweb/video-player
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
Modified: 9/10/2026
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover
Modified: 9/10/2026