CVE-2025-49141: high-severity vulnerability in haxtheweb issues
HaxCMS-PHP Command Injection Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 1.6%
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string from a POST request and insufficiently validates user input. The `set_remote` function later passes this input into `proc_open`, yielding OS command injection. An authenticated attacker can craft a URL string that bypasses the validation checks employed by the `filter_var` and `strpos` functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request. Version 11.0.3 contains a patch for the issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
haxtheweb · issuesRelated CVEs — haxtheweb issues
In the same product, most dangerous first.
CVE-2025-32028CRITICALHAX CMS PHP allows Insecure File Upload to Lead to Remote Code ExecutionEPSS 2.0%CVE-2026-22704HIGHHAXcms Has Stored XSS Vulnerability that May Lead to Account TakeoverEPSS 1.0%CVE-2025-54378HIGHHAX CMS Backend Lacks Comprehensive Authorization ChecksEPSS 0.6%CVE-2025-49138MEDIUMHAX CMS vulnerable to Local File Inclusion via saveOutline API Location ParameterEPSS 0.5%CVE-2025-54134HIGHHAX CMS NodeJs's Improper Error Handling Leads to Denial of ServiceEPSS 0.5%CVE-2025-54127CRITICALHAXcms's Insecure Default Configuration Leads to Unauthenticated AccessEPSS 0.5%