HAX CMS application pages vulnerable to clickjacking
Summary
All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.
PoC
To replicate this vulnerability, load the target page in an iframe and observe the rendered content.
Impact
An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | elmsln/haxcms | < 11.0.8 | 11.0.8 |
| npm package | @haxtheweb/haxcms-nodejs | < 11.0.13 | 11.0.13 |
References
- https://github.com/haxtheweb/issues/security/advisories/GHSA-54vw-f4xf-f92j
- https://nvd.nist.gov/vuln/detail/CVE-2025-54139
- https://github.com/haxtheweb/haxcms-nodejs/commit/777f9a7ff9675a160496f350d766df1f1f9b9b99
- https://github.com/haxtheweb/haxcms-php/commit/708dc8518928fe307044e67bff8b0f397cfdd606
- https://github.com/haxtheweb/issues
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-1021- Platform
- Composer, npm
- Package
elmsln/haxcms, @haxtheweb/haxcms-nodejs- Disclosed
- 21.07.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-54vw-f4xf-f92j - CC BY 4.0
Vulnerability history: elmsln/haxcms
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 06.2025 07.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 2
Disclosures per year
- 2025: 4
- 2026: 0
-
HAX CMS application pages vulnerable to clickjacking this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.