Skip to content
Threat Feed

Tag

Haxcms

3 briefs RSS
critical advisory

HAXcms Cross-Tenant Account Takeover via Stored XSS and Token Exposure

HAXcms is vulnerable to stored XSS and exposes authentication tokens in the `/system/api/connectionSettings` endpoint, allowing an attacker to perform cross-tenant account takeover by injecting malicious JavaScript to steal the `jwt`, `user_token`, `site_token`, and `appstore_token`.

haxcms-nodejs haxcms xss account-takeover
2r 2t
critical advisory

HAXcms Node.js Backend Private Key Disclosure via Broken HMAC Implementation

The HAXcms Node.js backend contains two cryptographic implementation errors in the `hmacBase64()` function that allow an unauthenticated attacker to extract the system’s private signing key and forge arbitrary admin-level JSON Web Tokens (JWTs) allowing them to get full admin access with a single HTTP request.

@haxtheweb/haxcms-nodejs cve-2026-46395 haxcms key-disclosure jwt privilege-escalation
2r 1t
high advisory

HAXcms createSite SSRF Enables Arbitrary File Read

HAXcms is vulnerable to Server-Side Request Forgery (SSRF) via the createSite endpoint, allowing an authenticated user to supply arbitrary URLs or local file paths, which are fetched server-side without validation and written to a web-accessible directory, enabling arbitrary file read, internal network access, and cloud credential exposure; this vulnerability is tracked as CVE-2026-46393.

HAXcms ssrf cve-2026-46393 vulnerability
2r 1t 2i