CVE-2026-22704 json
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
published 2026-01-10 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-1866 , GHSA-3fm2-xfq7-7778
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 1
- Exploit-DB
Summary
HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.
Patch / fix
- npm @haxtheweb/haxcms-nodejs 25.0.0
- haxtheweb hax 25.0.0
- haxtheweb haxcms-php 25.0.0
- psu haxcms-php 25.0.0
- haxtheweb haxcms-nodejs 25.0.0
- psu haxcms-nodejs 25.0.0
Timeline
- Published
- First public exploit (EDB-52526)
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 9 mo ago
Exploit prediction
1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-52526 HAX CMS 24.x - Stored Cross-Site Scripting (XSS) webapps, 2026-04-29
- github.com https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @haxtheweb/haxcms-nodejs | >=11.0.6, <25.0.0 |
25.0.0 |
Affected products
- haxtheweb issues
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e
web, patch
-
github.com
/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778
web, exploit, vendor-advisory
-
github.com
/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-22704
advisory
-
github.com
/haxtheweb/issues
package
Sources
- CVE List CVE-2026-22704
- GitHub Advisory GHSA-3fm2-xfq7-7778
- NVD CVE-2026-22704
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.