MEDIUMnpm
GHSA-2m6p-hm3w-6jm3· CVE-2026-46496HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
Modified: 9/10/2026
package
npm/@haxtheweb/video-player
pkg:npm/%40haxtheweb/video-player
HIGHnpm
GHSA-jh3h-rpxg-fr36· CVE-2026-46396Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover
Modified: 9/10/2026