CVE-2025-49137

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a `script` tag, it does allow the use of other HTML tags to run JavaScript. Version 11.0.0 fixes the issue.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/haxtheweb/haxcms-php/commit/0dd3e98fe2fadd0793b667d4af2aac230980e0f8	Patch
https://github.com/haxtheweb/issues/security/advisories/GHSA-2vc4-3hx7-v7v7	Third Party Advisory Exploit Issue Tracking
https://github.com/haxtheweb/issues/security/advisories/GHSA-2vc4-3hx7-v7v7	Third Party Advisory Exploit Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:haxtheweb:haxcms-nodejs::::::node.js::*
	cpe:2.3:a:haxtheweb:haxcms-php::::::::

History

20 Jun 2025, 14:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-09 21:15

Updated : 2025-06-20 14:28

NVD link : CVE-2025-49137

Mitre link : CVE-2025-49137

CVE.ORG link : CVE-2025-49137

JSON object : View

Products Affected

haxtheweb

haxcms-nodejs
haxcms-php

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-87

Improper Neutralization of Alternate XSS Syntax

{"id": "CVE-2025-49137", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-06-09T21:15:46.890", "references": [{"url": "https://github.com/haxtheweb/haxcms-php/commit/0dd3e98fe2fadd0793b667d4af2aac230980e0f8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-2vc4-3hx7-v7v7", "tags": ["Third Party Advisory", "Exploit", "Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-2vc4-3hx7-v7v7", "tags": ["Third Party Advisory", "Exploit", "Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}, {"lang": "en", "value": "CWE-87"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a `script` tag, it does allow the use of other HTML tags to run JavaScript. Version 11.0.0 fixes the issue."}, {"lang": "es", "value": "HAX CMS PHP permite a los usuarios gestionar su universo de micrositios con un backend PHP. Antes de la versi\u00f3n 11.0.0, la aplicaci\u00f3n no depuraba adecuadamente la entrada del usuario, lo que permit\u00eda la ejecuci\u00f3n de c\u00f3digo JavaScript arbitrario. Los endpoints \"saveNode\" y \"saveManifest\" reciben la entrada del usuario y la almacenan en el esquema JSON del sitio. Este contenido se renderiza en el sitio HAX generado. Aunque la aplicaci\u00f3n no permite a los usuarios proporcionar una etiqueta `script`, s\u00ed permite el uso de otras etiquetas HTML para ejecutar JavaScript. La versi\u00f3n 11.0.0 soluciona este problema."}], "lastModified": "2025-06-20T14:28:09.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haxtheweb:haxcms-nodejs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "19A63310-AD1C-4487-BF09-2AE71EA9A5B6", "versionEndExcluding": "11.0.0"}, {"criteria": "cpe:2.3:a:haxtheweb:haxcms-php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A305A52-060B-44E0-A216-AB1ABA968828", "versionEndExcluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}