CVE Feed

    Dashboard / CVE / CVE-2025-32028

    CVE-2025-32028

    HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.

    Published:Apr 8, 2025
    Last Modified:Jul 30, 2025
    EPS:Apr 8, 2025
    EPSS Score:0.00064
    CVSS Score:10

    Affected Products

    Vendor
    Psu
    Product
    Haxcms-php

    Exploits

    https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5phttps://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2025-54378 (CVSS 8.3) — HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and belo…
    CVE-2025-54139 (CVSS 4.3) — HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs version…
    CVE-2025-53642 (CVSS 4.8) — haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not term…
    CVE-2025-49141 (CVSS 8.5) — HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `…
    CVE-2025-49139 (CVSS 5.3) — HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in th…
    CVE-2025-49138 (CVSS 6.5) — HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an au…
    CVE-2025-49137 (CVSS 8.5) — HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High