PT-2025-30344 · Hax Cms · Hax Cms

Asareynolds · Published 2025-07-21 · Updated 2025-07-22 · CVE-2025-54127

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HAXcms versions prior to 11.0.7

Description HAXcms with a nodejs backend allows users to start the server in any HAXsite or HAXcms instance. The NodeJS version of HAXcms, in versions 11.0.6 and below, uses an insecure default configuration intended for local development. This configuration lacks session authentication because the HAXCMS DISABLE JWT CHECKS variable is set to true by default.

Recommendations HAXcms versions prior to 11.0.7: Update to version 11.0.7 or later.

Exploit

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-54127

GHSA-F38F-JVQJ-MFG6

Affected Products

Hax Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54127.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54127 · Security Note
• https://osv.dev/vulnerability/GHSA-f38f-jvqj-mfg6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54127 · Vendor Advisory
• https://github.com/haxtheweb/issues/security/advisories/GHSA-f38f-jvqj-mfg6 · Note
• https://github.com/haxtheweb/haxcms-nodejs · Note
• https://twitter.com/VulmonFeeds/status/1947474007642505553 · Twitter Post
• https://t.me/cvetracker/28333 · Telegram Post
• https://twitter.com/CVEnew/status/1947405329622569410 · Twitter Post
• https://t.me/cvenotify/129751 · Telegram Post