{"kind": "product", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "name": "@haxtheweb/haxcms-nodejs", "product": "@haxtheweb/haxcms-nodejs", "ecosystem": "npm", "items": [{"id": "CVE-2026-46357", "noindex": false, "published": "2026-06-05T19:21:03.297Z", "modified": "2026-06-09T14:36:15.648Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.0024, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-46357", "title": "HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request", "description": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp", "https://nvd.nist.gov/vuln/detail/CVE-2026-46357"], "fixes": ["26.0.0"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2026-46496", "noindex": false, "published": "2026-06-05T18:46:36.822Z", "modified": "2026-06-05T19:10:41.697Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "severity": "critical", "epss": 0.0023, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-46496", "title": "HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft", "description": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs in the `source` attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more. Version 26.0.0 fixes the issue.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-2m6p-hm3w-6jm3", "https://nvd.nist.gov/vuln/detail/CVE-2026-46496"], "fixes": ["26.0.0"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2026-46396", "noindex": false, "published": "2026-06-05T18:44:28.997Z", "modified": "2026-06-09T14:36:27.436Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "severity": "critical", "epss": 0.0023, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-46396", "title": "HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover", "description": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36", "https://nvd.nist.gov/vuln/detail/CVE-2026-46396"], "fixes": ["26.0.0"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2026-46511", "noindex": false, "published": "2026-06-05T18:32:55.498Z", "modified": "2026-06-08T15:55:20.156Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00275, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-46511", "title": "HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack", "description": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover. The API dynamically leaks the active session's authentication tokens (including the `jwt`, `user_token`, `site_token`, and `appstore_token`) into a global JavaScript variable (`window.appSettings`). An attacker can exploit the XSS vulnerability to force a victim's browser to silently fetch their specific connection settings, extract the tokens, and ", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-x3x5-7h4h-gwxg", "https://nvd.nist.gov/vuln/detail/CVE-2026-46511"], "fixes": ["26.0.0"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2026-46395", "noindex": false, "published": "2026-06-05T18:27:54.224Z", "modified": "2026-06-05T19:41:40.542Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00295, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-46395", "title": "HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation", "description": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing key and forge arbitrary admin-level JSON Web Tokens (JWTs) allowing them to get full admin access with a single HTTP request. First, the function passes the literal string \"0\" as the HMAC signing key instead of the key parameter, making every HAXcms instance compute identical HMACs for the same input. Then, after computing the HMAC, the function con", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-6c8g-9hfh-pq5h", "https://nvd.nist.gov/vuln/detail/CVE-2026-46395"], "fixes": ["26.0.0"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2026-46393", "noindex": false, "published": "2026-06-05T18:24:49.719Z", "modified": "2026-06-08T16:08:41.968Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00238, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-46393", "title": "HAXcms createSite SSRF Enables Arbitrary File Read", "description": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Version 26.0.0 contains a fix.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-q862-gcgq-5m6g", "https://nvd.nist.gov/vuln/detail/CVE-2026-46393"], "fixes": ["26.0.0"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2026-48527", "noindex": false, "published": "2026-05-29T12:26:07.972Z", "modified": "2026-05-29T13:02:50.194Z", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00228, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-48527", "title": "HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint", "description": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-g2g8-95qg-v35h", "https://nvd.nist.gov/vuln/detail/CVE-2026-48527"], "fixes": ["26.0.1"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2026-22704", "noindex": false, "published": "2026-01-10T06:22:45.076Z", "modified": "2026-01-13T15:09:03.814Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.01026, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-22704", "title": "HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover", "description": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778", "https://github.com/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e", "https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0"], "fixes": ["25.0.0"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2025-54378", "noindex": false, "published": "2025-07-26T03:27:34.305Z", "modified": "2025-07-28T19:01:27.428Z", "cvss": 8.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "severity": "high", "epss": 0.0057, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-54378", "title": "HAX CMS Backend Lacks Comprehensive Authorization Checks", "description": "HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-9jr9-8ff3-m894", "https://github.com/haxtheweb/haxcms-nodejs/commit/5826e9b7f3d8c7c7635411768b86b199fad36969", "https://github.com/haxtheweb/haxcms-php/commit/24d30222481ada037597c4d7c0a51a1ef7af6cfd"], "fixes": ["11.0.14"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2025-54139", "noindex": false, "published": "2025-07-22T23:24:13.334Z", "modified": "2025-07-23T14:53:40.521Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00356, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-54139", "title": "HAX CMS' application pages are vulnerable to clickjacking", "description": "HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-54vw-f4xf-f92j", "https://github.com/haxtheweb/haxcms-nodejs/commit/777f9a7ff9675a160496f350d766df1f1f9b9b99", "https://github.com/haxtheweb/haxcms-php/commit/708dc8518928fe307044e67bff8b0f397cfdd606"], "fixes": ["11.0.13"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2025-54137", "noindex": false, "published": "2025-07-22T21:34:20.201Z", "modified": "2025-07-23T18:27:54.073Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "high", "epss": 0.00394, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-54137", "title": "NodeJS version of the HAX CMS application is distributed with Default Secrets", "description": "HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and p", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-5fpv-5qvh-7cf3", "https://github.com/haxtheweb/haxcms-nodejs/commit/6dc2441c876350ca6fe9fbaecb058d92ef442869", "https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/lib/HAXCMS.js#L1614"], "fixes": ["11.0.10"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2025-54134", "noindex": false, "published": "2025-07-21T20:58:35.724Z", "modified": "2025-07-23T18:30:23.112Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00472, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-54134", "title": "HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service", "description": "HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-pjj3-j5j6-qj27", "https://github.com/haxtheweb/haxcms-nodejs/commit/e9773d1996233f9bafb06832b8220ec2a98bab34", "https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22"], "fixes": ["11.0.9"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2025-54128", "noindex": false, "published": "2025-07-21T20:46:31.660Z", "modified": "2025-07-22T20:43:50.054Z", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N", "severity": "high", "epss": 0.0023, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-54128", "title": "HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting", "description": "HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js. This is fixed in version 11.0.8.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-59g8-h59f-8hjp", "https://github.com/haxtheweb/haxcms-nodejs/commit/ddb9351c6d6418008d4084a5b17fd6d611bc4e30", "https://nvd.nist.gov/vuln/detail/CVE-2025-54128"], "fixes": ["11.0.8"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2025-54127", "noindex": false, "published": "2025-07-21T20:36:43.580Z", "modified": "2025-07-22T19:56:43.124Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00456, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-54127", "title": "HAXcms's Insecure Default Configuration Leads to Unauthenticated Access", "description": "HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication. This is fixed in version 11.0.7.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-f38f-jvqj-mfg6", "https://nvd.nist.gov/vuln/detail/CVE-2025-54127"], "fixes": ["11.0.7"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2025-49141", "noindex": false, "published": "2025-06-09T21:11:08.889Z", "modified": "2025-06-10T15:29:29.971Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.01487, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-49141", "title": "HaxCMS-PHP Command Injection Vulnerability", "description": "HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string from a POST request and insufficiently validates user input. The `set_remote` function later passes this input into `proc_open`, yielding OS command injection. An authenticated attacker can craft a URL string that bypasses the validation checks employed by the `filter_var` and `strpos` functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request. Version 11.0.3 contains a patch for the issue.", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-g4cf-pp4x-hqgw", "https://github.com/haxtheweb/haxcms-nodejs/commit/5131fea6b6be611db76a618f89bd2e164752e9b3", "https://nvd.nist.gov/vuln/detail/CVE-2025-49141"], "fixes": ["11.0.3"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}, {"id": "CVE-2025-49139", "noindex": false, "published": "2025-06-09T21:08:44.391Z", "modified": "2025-06-10T15:29:40.105Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0037, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-49139", "title": "@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability", "description": "HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is visited, the client's browser will query the supplied URL. An authenticated attacker can create a HAX site with a website block pointing at an attacker-controlled server running Responder or a similar tool. The attacker can then conduct a phishing attack by convincing another user to visit their malicious HAX site to harvest credentials. Version 11.0.0 con", "references": ["https://github.com/haxtheweb/issues/security/advisories/GHSA-v3ph-2q5q-cg88", "https://github.com/haxtheweb/haxcms-nodejs/commit/5368eb9b278ca47cd9a83b8d3e6216375615b8f5", "https://nvd.nist.gov/vuln/detail/CVE-2025-49139"], "fixes": ["11.0.0"], "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}]}], "total": 16, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "@haxtheweb/haxcms-nodejs", "path": "vulns/npm/@haxtheweb%2Fhaxcms-nodejs", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-06-09T14:36:27.436Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}