← Back

CVE-2025-53642

nvd nist
Published: Jul 11, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 3.9 / Impact: 2.5
Source: NVD

Description

haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.

Affected (2)

Psu
2 products
Haxcms Nodejs
Haxcms Php
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Haxcms Nodejs
Before 11.0.6
Haxcms Php
Before 11.0.6

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

Source: security-advisories@github.com
Issue TrackingThird Party Advisory

Timeline

No history available yet.