CVE-2026-46357

Published: Jun 5, 2026Modified: Jul 23, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp

Source: security-advisories@github.com

https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.