CVE-2025-53642: haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies…

PriorityP432medium6.5CVSS 3.1

AVNACLPRNUINSUCLILAN

EPSS

0.17%

6.1th percentile

haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
haxtheweb	issues	< 11.0.6	11.0.6
psu	haxcms-nodejs	< 11.0.6	11.0.6
psu	haxcms-php	< 11.0.6	11.0.6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.