EUVD-2026-265549

fkie_cve-2026-22704

HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.

GHSA-3fm2-xfq7-7778 — HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

Affected: npm: @haxtheweb/haxcms-nodejs

### Summary Stored XSS Leading to Account Takeover

### Details The Exploit Chain: 1.Upload: The attacker uploads an `.html` file containing a JavaScript payload. 2.Execution: A logged-in administrator is tricked into visiting the URL of this uploaded file. 3.Token Refresh: The JavaScript payload makes a `fetch` request to the `/system/api/refreshAccessToken` endpoint. Because the administrator is logged in, their browser automatically attaches the `haxcms_refresh_token` cookie to this request. 4.JWT Theft: The server validates the refresh token and responds with a new, valid JWT access token in the JSON response. 5.Exfiltration: The JavaScript captures this new JWT from the response and sends it to an attacker-controlled server. 6.Account Takeover: The attacker now possesses a valid administrator JWT and can take full control of the application.

Vulnerability recurrence:

Then we test access to this html

You can obtain other people's identity information

### PoC POST /system/api/saveFile?siteName=yu&site_token=neWmRyvNbCCwiQ7MP2ojAjVMk-HtjlKYNOqsQjLt3RQ&jwt=eyJ0eXAiOiJKV1QiLCJh…

Most recent entries from all

EUVD-2026-265549

fkie_cve-2026-22704

GHSA-3fm2-xfq7-7778 — HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover