PT-2025-30361 · Hax Cms · Hax Cms

Lfgberg + 1 · Published 2025-07-21 · Updated 2025-07-23 · CVE-2025-54139

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HAX CMS versions 11.0.7 and below (PHP) HAX CMS versions 11.0.12 and below (NodeJS)

Description HAX CMS does not include headers to prevent websites from loading the application within an iframe. This affects both the CMS and generated sites. An unauthenticated attacker can load sensitive functionality, such as the login page, within an iframe, enabling a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to coerce users into performing unintended actions.

Recommendations HAX CMS versions 11.0.7 and below (PHP): Update to version 11.0.8 or later. HAX CMS versions 11.0.12 and below (NodeJS): Update to version 11.0.13 or later.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2025-54139

GHSA-54VW-F4XF-F92J

Affected Products

Hax Cms

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54139.json · Exploit
• 🔥 https://github.com/haxtheweb/issues/security/advisories/GHSA-54vw-f4xf-f92j · Exploit
• https://github.com/haxtheweb/haxcms-php/commit/708dc8518928fe307044e67bff8b0f397cfdd606 · Patch
• https://github.com/haxtheweb/haxcms-nodejs/commit/777f9a7ff9675a160496f350d766df1f1f9b9b99 · Patch
• https://osv.dev/vulnerability/GHSA-54vw-f4xf-f92j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54139 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54139 · Vendor Advisory
• https://github.com/haxtheweb/issues · Note
• https://t.me/cvetracker/28439 · Telegram Post
• https://t.me/CVEtracker/28439 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947837530285445352 · Twitter Post
• https://twitter.com/CVEnew/status/1947808269831180381 · Twitter Post