Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. Details The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. Affected Resources - Operations.php: 760 createNode() - Operations.php: 868 saveNode() - Operations.php: 1171 deleteNode() - Operations.php: 1789 listSites() - Operations.php: 1890 createSite() - Operations.php: 2196 getConfig() - Operations.php: 2389 cloneSite() - Operations.php: 2467 deleteSite() - Operations.php: 2524 downloadSite() - Operations.php: 2607 archiveSite() Note: This may not include all affected endpoints within the application. Impact An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete…
Recommended action: Upgrade to 11.0.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites. PoC To replicate this vulnerability, load the target page in an iframe and observe the rendered content. Impact An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.
Recommended action: Upgrade to 11.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Details The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input. Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file. PoC 1.…
Recommended action: Upgrade to 11.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript. Affected Resources - Operations.php:258 saveManifest() - Operations.php:868 saveNode() - https://<site/<user/system/api/saveNode - https://<site/<user/system/api/saveManifest Impact An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data. PoCs saveNode To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious…
Recommended action: Upgrade to 11.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.