PT-2025-30359 · Unknown · Haxcms-Nodejs

Published 2025-07-21 · Updated 2025-07-23 · CVE-2025-54137

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions HAX CMS NodeJS versions 11.0.9 and below

Description HAX CMS NodeJS is distributed with hardcoded default credentials for user and superuser accounts and default private keys for JWTs. Users are not prompted to change these credentials or secrets during installation, and there is no way to change them through the user interface. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories, potentially allowing access to unconfigured instances, site modification, and further attacks.

Recommendations HAX CMS NodeJS version 11.0.10 and later should be used.

Exploit

Fix

Weakness Enumeration

CWE-1392

Related Identifiers

CVE-2025-54137

GHSA-5FPV-5QVH-7CF3

Affected Products

Haxcms-Nodejs

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54137.json · Exploit
• https://github.com/haxtheweb/haxcms-nodejs/commit/6dc2441c876350ca6fe9fbaecb058d92ef442869 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-54137 · Security Note
• https://osv.dev/vulnerability/GHSA-5fpv-5qvh-7cf3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54137 · Vendor Advisory
• https://github.com/haxtheweb/issues · Note
• https://github.com/haxtheweb/issues/security/advisories/GHSA-5fpv-5qvh-7cf3 · Note
• https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/lib/HAXCMS.js#L1614 · Note
• https://t.me/cvetracker/28422 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947865688598548929 · Twitter Post
• https://t.me/CVEtracker/28422 · Telegram Post
• https://t.me/cveNotify/129921 · Telegram Post
• https://twitter.com/CVEnew/status/1947776820323226063 · Twitter Post