Vulnerabilidades en haxtheweb
33 resultadosAnálisis Vexday
A haxtheweb apresenta 33 vulnerabilidades catalogadas, com 17 divulgadas nos últimos 90 dias, indicando exposição contínua a novos riscos. Nenhuma está sob exploração ativa documentada (KEV), mas 6 atingem severidade crítica, com a injeção de conteúdo (CWE-79) dominando o perfil de vulnerabilidade. O ritmo acelerado de descobertas recentes sugere necessidade de monitoramento próximo e priorização das críticas.
CVE-2025-32028CRITICALHAX CMS PHP allows Insecure File Upload to Lead to Remote Code ExecutionEPSS 2.0%CVE-2025-49141HIGHHaxCMS-PHP Command Injection VulnerabilityEPSS 1.5%CVE-2026-22704HIGHHAXcms Has Stored XSS Vulnerability that May Lead to Account TakeoverEPSS 1.0%CVE-2026-46394HIGHHAX CMS Vulnerable to Command Injection using Git.phpEPSS 0.9%CVE-2026-46400HIGHHAXCMS PHP has a File Upload Validation BypassEPSS 0.6%CVE-2026-46391HIGHHAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apisEPSS 0.5%CVE-2026-35185HIGHHAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addressesEPSS 0.5%CVE-2025-49138MEDIUMHAX CMS vulnerable to Local File Inclusion via saveOutline API Location ParameterEPSS 0.5%CVE-2026-46401MEDIUMHAX CMS PHP has Insufficient Session ExpirationEPSS 0.5%CVE-2026-46493HIGHhaxtheweb/haxcms-php uses insecure method for generating saltEPSS 0.5%CVE-2026-46399CRITICALAuthenticated Remote Code Execution via File OverwriteEPSS 0.5%CVE-2026-46511HIGHHAXcms: Mass Token Exfiltration and Cross-Tenant HijackEPSS 0.5%CVE-2025-54378HIGHHAX CMS Backend Lacks Comprehensive Authorization ChecksEPSS 0.5%CVE-2026-46397MEDIUMhaxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0EPSS 0.4%CVE-2026-46390MEDIUMHAX CMS has Unauthenticated Git Access via User-Controlled KeyEPSS 0.4%CVE-2025-54134HIGHHAX CMS NodeJs's Improper Error Handling Leads to Denial of ServiceEPSS 0.4%CVE-2026-46357MEDIUMHAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import RequestEPSS 0.4%CVE-2025-54127CRITICALHAXcms's Insecure Default Configuration Leads to Unauthenticated AccessEPSS 0.4%CVE-2026-46396CRITICALHAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeoverEPSS 0.4%CVE-2026-46496CRITICALHAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theftEPSS 0.4%