PT-2025-23555 · Hax · Hax Open-Apis+1

23Younesm · Published 2025-06-02 · Updated 2025-06-05 · CVE-2025-48996

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HAX open-apis versions up to and including 10.0.2

Description An unauthenticated information disclosure issue exists in the HAX content management system via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When combined with other authorization issues, this could assist in targeted attacks such as unauthorized content modification or deletion.

Recommendations For HAX open-apis versions up to and including 10.0.2, apply the patch from commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 to resolve the issue. As a temporary workaround, consider restricting access to the haxPsuUsage API endpoint until the patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-48996

GHSA-FVX2-X7FF-FC56

Affected Products

Hax Cms

Hax Open-Apis

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48996.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-48996 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvx2-x7ff-fc56 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48996 · Security Note
• https://github.com/haxtheweb/issues · Note
• https://github.com/haxtheweb/issues/security/advisories/GHSA-fvx2-x7ff-fc56 · Note
• https://github.com/haxtheweb/open-apis/commit/06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 · Note
• https://twitter.com/CVEnew/status/1929624877579096074 · Twitter Post
• https://t.me/cvetracker/25219 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1929686180108308624 · Twitter Post