CVE-2026-46357: falha de média gravidade em haxtheweb haxcms-nodejs
HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.2%
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
haxtheweb · haxcms-nodejsCVEs relacionadas — haxtheweb haxcms-nodejs
No mesmo produto, das mais perigosas para as menos.
CVE-2026-46395CRITICALHAX CMS Vulnerable to Private Key Disclosure via Broken HMAC ImplementationEPSS 0.3%CVE-2026-46399CRITICALAuthenticated Remote Code Execution via File OverwriteEPSS 0.3%CVE-2026-46397MEDIUMhaxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0EPSS 0.3%CVE-2026-46511HIGHHAXcms: Mass Token Exfiltration and Cross-Tenant HijackEPSS 0.3%CVE-2026-46393HIGHHAXcms createSite SSRF Enables Arbitrary File ReadEPSS 0.2%CVE-2026-46496CRITICALHAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theftEPSS 0.2%