https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:07:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-248276 EUVD-2026-248276 https://cve.radiocsirt.org/vuln/euvd-2026-248276 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54128 <p>HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application&#39;s Helmet configuration in app.js. This is fixed in version 11.0.8.</p> <p>HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application&#39;s Helmet configuration in app.js. This is fixed in version 11.0.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54128 https://cve.radiocsirt.org/vuln/ghsa-59g8-h59f-8hjp <p><strong>Affected:</strong> npm: @haxtheweb/haxcms-nodejs</p> <p>### Summary The NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks.</p> <p>### Details The `contentSecurityPolicy` value is explicitly disabled in the application&#39;s Helmet configuration in `app.js`.</p> <p></p> <p>#### Affected Resources - [app.js:52](https://github.com/haxtheweb/haxcms-nodejs/blob/b1f95880b42fea6ed07855b5804b29b182ec5e07/src/app.js#L52)</p> <p>### PoC To reproduce this vulnerability, [install](https://github.com/haxtheweb/haxcms-nodejs) HAX CMS NodeJS. The application will load without a CSP configured.</p> <p>### Impact In conjunction with an XSS vulnerability, an attacker could execute arbitrary scripts and exfiltrate data, including session tokens and sensitive local data.</p> <p>#### Additional Information - [OWASP: Content Security Policy](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)</p> <p><strong>Affected:</strong> npm: @haxtheweb/haxcms-nodejs</p> <p>### Summary The NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks.</p> <p>### Details The `contentSecurityPolicy` value is explicitly disabled in the application&#39;s Helmet configuration in `app.js`.</p> <p></p> <p>#### Affected Resources - [app.js:52](https://github.com/haxtheweb/haxcms-nodejs/blob/b1f95880b42fea6ed07855b5804b29b182ec5e07/src/app.js#L52)</p> <p>### PoC To reproduce this vulnerability, [install](https://github.com/haxtheweb/haxcms-nodejs) HAX CMS NodeJS. The application will load without a CSP configured.</p> <p>### Impact In conjunction with an XSS vulnerability, an attacker could execute arbitrary scripts and exfiltrate data, including session tokens and sensitive local data.</p> <p>#### Additional Information - [OWASP: Content Security Policy](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)</p> https://cve.radiocsirt.org/vuln/ghsa-59g8-h59f-8hjp