Medium severity · published Jul 21, 2025
CVE-2025-54134
HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
issues · haxtheweb
< 11.0.9 · source: vendor
HA
Haxcms-nodejs · Psu
before 11.0.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54134
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54134
Product
https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22
Product
https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/saveFile.js#L52
Patch
https://github.com/haxtheweb/haxcms-nodejs/commit/e9773d1996233f9bafb06832b8220ec2a98bab34
Third Party Advisory
https://github.com/haxtheweb/issues/security/advisories/GHSA-pjj3-j5j6-qj27
More from issues
9.9
CVE-2025-32028
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
9.8
CVE-2025-54127
HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
8.8
CVE-2025-49141
HaxCMS-PHP Command Injection Vulnerability
8.3
CVE-2025-54378
HAX CMS Backend Lacks Comprehensive Authorization Checks
7.3
CVE-2025-54137
NodeJS version of the HAX CMS application is distributed with Default Secrets