PT-2026-47042 · Haxtheweb · Hax Cms Php

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-46493

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use uniqid for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2026-46493

Affected Products

Hax Cms Php

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-46493 · Security Note
• https://github.com/haxtheweb/haxcms-php/blob/8b8845b16e521a326929471e16903f60c6638e8f/install.php#L188-L191 · Note
• https://github.com/haxtheweb/haxcms-php/commit/4b83cbdf8782c75bdcdd4f57ba72fba1c6dac147 · Note
• https://github.com/haxtheweb/issues/security/advisories/GHSA-xg43-xm47-74cp · Note