CVE-2025-49139
CVE-2025-49139 · @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is visited, the client's browser will query the supplied URL. An authenticated attacker can create a HAX site with a website block pointing at an attacker-controlled server running Responder or a similar tool. The attacker can then conduct a phishing attack by convincing another user to visit their malicious HAX site to harvest credentials. Version 11.0.0 contains a patch for the issue.
CVSS 5.3 · Media · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
issues
- Versiones
- < 11.0.0: Afectada
Sin corrección publicada
@haxtheweb/haxcms-nodejs npm
- Intervalos de versiones afectados
- SEMVER: < 11.0.0
Actualiza a 11.0.0