PT-2025-24564 · Hax Cms · Hax Cms

Lfgberg + 1 · Published 2025-06-09 · Updated 2025-06-09 · CVE-2025-49139

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HAX CMS PHP versions prior to 11.0.0

Description The issue allows an authenticated attacker to create a HAX site with a website block that can load another site in an iframe, potentially leading to phishing attacks. When a user visits the malicious HAX site, their browser will query the supplied URL, which can be controlled by the attacker. This can be exploited by convincing another user to visit the malicious site, allowing the attacker to harvest credentials.

Recommendations For versions prior to 11.0.0, update to version 11.0.0 to resolve the issue. As a temporary workaround, consider restricting the use of the website block feature in the HAX site editor to minimize the risk of exploitation.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2025-49139

GHSA-V3PH-2Q5Q-CG88

Affected Products

Hax Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49139.json · Exploit
• 🔥 https://github.com/haxtheweb/issues/security/advisories/GHSA-v3ph-2q5q-cg88 · Exploit
• https://github.com/haxtheweb/haxcms-nodejs/commit/5368eb9b278ca47cd9a83b8d3e6216375615b8f5 · Patch
• https://osv.dev/vulnerability/GHSA-v3ph-2q5q-cg88 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49139 · Security Note
• https://github.com/haxtheweb/issues · Note
• https://twitter.com/CVEnew/status/1932189075601256805 · Twitter Post
• https://t.me/cvetracker/25830 · Telegram Post