CVE-2025-54139: HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions…

PriorityP430medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.30%

21.6th percentile

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
elmsln	haxcms	>= 0 < 11.0.8	11.0.8
haxtheweb	haxcms-nodejs	>= 0 < 11.0.13	11.0.13
haxtheweb	issues	< 11.0.13	11.0.13
haxtheweb	issues	< 11.0.8	11.0.8
psu	haxcms-nodejs	>= 11.0.6 < 11.0.13	11.0.13
psu	haxcms-php	>= 11.0.0 < 11.0.8	11.0.8

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.