PT-2025-30345 · Unknown · Haxcms-Nodejs

Asareynolds · Published 2025-07-21 · Updated 2025-07-22 · CVE-2025-54128

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions HAX CMS NodeJs versions 11.0.7 and below

Description HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. The NodeJS version of HAX CMS has a disabled Content Security Policy (CSP) in versions 11.0.7 and below. This configuration does not protect against cross-site-scripting attacks because the contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js.

Recommendations HAX CMS NodeJs version 11.0.8 or later should be used.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-54128

GHSA-59G8-H59F-8HJP

Affected Products

Haxcms-Nodejs

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54128.json · Exploit
• https://github.com/haxtheweb/haxcms-nodejs/commit/ddb9351c6d6418008d4084a5b17fd6d611bc4e30 · Patch
• https://osv.dev/vulnerability/GHSA-59g8-h59f-8hjp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54128 · Security Note
• https://github.com/haxtheweb/issues/security/advisories/GHSA-59g8-h59f-8hjp · Note
• https://github.com/haxtheweb/haxcms-nodejs · Note
• https://twitter.com/VulmonFeeds/status/1947471447741399226 · Twitter Post
• https://twitter.com/CVEnew/status/1947405328699822552 · Twitter Post
• https://t.me/cvetracker/28334 · Telegram Post