CVE Feed

    Dashboard / CVE / CVE-2025-49137

    CVE-2025-49137

    HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a `script` tag, it does allow the use of other HTML tags to run JavaScript. Version 11.0.0 fixes the issue.

    Published:Jun 9, 2025
    Last Modified:Jul 30, 2025
    EPS:Jun 9, 2025
    EPSS Score:0.00048
    CVSS Score:8.5

    Affected Products

    Vendor
    Psu
    Product
    Haxcms-nodejs
    Vendor
    Psu
    Product
    Haxcms-php

    Exploits

    https://github.com/haxtheweb/issues/security/advisories/GHSA-2vc4-3hx7-v7v7https://github.com/haxtheweb/issues/security/advisories/GHSA-2vc4-3hx7-v7v7

    Related CVEs

    CVE-2026-22704 (CVSS 8) — HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX …
    CVE-2025-54378 (CVSS 8.3) — HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and belo…
    CVE-2025-54139 (CVSS 4.3) — HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs version…
    CVE-2025-54137 (CVSS 7.3) — HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and belo…
    CVE-2025-54134 (CVSS 7.1) — HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and b…
    CVE-2025-54128 (CVSS 7.2) — HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and b…
    CVE-2025-54127 (CVSS 9.3) — HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.…
    CVE-2025-53642 (CVSS 4.8) — haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not term…
    CVE-2025-49141 (CVSS 8.5) — HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `…
    CVE-2025-49139 (CVSS 5.3) — HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in th…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High