Login Request a demo
HA
Product
haxcms-php
by haxtheweb · last CVE Jun 5, 2026
11
CVEs
0
On KEV
9.4
Max CVSS
0
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 1High 8Medium 2Low 0
Severity
All severities11Critical1High8Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add haxcms-php to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-46399
9.4
0%
Jun 5
Authenticated Remote Code Execution via File Overwrite
Affected: < 26.0.0
CVE-2026-46398
8.8
0%
Jun 5
HAX CMS Missing Secure Flag on Cookie
Affected: >= 25.0.0, < 26.0.0
CVE-2026-46400
8.7
0%
Jun 5
HAXCMS PHP has a File Upload Validation Bypass
Affected: >= 11.0.6, < 25.0.0
CVE-2026-46511
8.7
0%
Jun 5
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
Affected: < 26.0.0
CVE-2026-46392
8.7
0%
Jun 5
HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation
Affected: < 26.0.0
CVE-2026-48527
8.7
0%
May 29
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint
Affected: < 26.0.2
CVE-2026-46394
7.7
1%
Jun 5
HAX CMS Vulnerable to Command Injection using Git.php
Affected: < 26.0.0
CVE-2026-46493
7.5
0%
Jun 5
haxtheweb/haxcms-php uses insecure method for generating salt
Affected: < 26.0.1
CVE-2026-46393
7.1
0%
Jun 5
HAXcms createSite SSRF Enables Arbitrary File Read
Affected: < 26.0.0
CVE-2026-46390
6.9
0%
Jun 5
HAX CMS has Unauthenticated Git Access via User-Controlled Key
Affected: >= 2.0.0, < 26.0.0
CVE-2026-46397
6.5
0%
Jun 5
haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0
Affected: < 26.0.0
Showing 11