Haxtheweb Issues vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Haxtheweb Issues: 2 record(s), with affected versions and fixes.
CVE-2026-46401
Medium · 5.3
CWE-613 Jun 5, 2026
HAX CMS PHP has Insufficient Session Expiration
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where authentication tokens remain valid after user logout. This allows attackers who obtain valid tokens to maintain persistent access to authenticated CMS functionality, bypassing the intended session termination mechanism and enabling unauthorized access to CMS metadata and administrative functions. Version 26.0.0 fixes the issue.
CVE-2026-22704
Medium · 5.4
Public exploit CWE-79 Jan 10, 2026
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.