PT-2026-30720 · Hax Cms · Hax Cms

Trigerman · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35185

Positive Technologies · (AI Summary)

CVSS v4.0

8.7

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions HAX CMS versions prior to 25.0.0

Description HAX CMS, used for managing microsite universes with PHP or NodeJs backends, has an issue where the /server-status endpoint is publicly accessible in versions prior to 25.0.0. This exposure allows unauthenticated users to access sensitive information, including authentication tokens (user token), user activity, client IP addresses, and server configuration details, enabling monitoring of real-time user interactions and gathering of internal infrastructure information.

Recommendations Update to version 25.0.0 or later.

Fix

Improper Access Control

Insufficiently Protected Credentials

Insertion into Log File

Weakness Enumeration

CWE-284

CWE-522

CWE-532

Related Identifiers

CVE-2026-35185

Affected Products

Hax Cms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35185 · Security Note
• https://github.com/haxtheweb/issues/security/advisories/GHSA-3676-wj6r-hwh7 · Note
• https://twitter.com/infoflowcloud/status/2041252396718784627 · Twitter Post
• https://twitter.com/CVEnew/status/2041250716493197440 · Twitter Post