CVE-2025-54139

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-54139
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54139.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-54139
Aliases
Published
2025-07-22T23:24:13.334Z
Modified
2026-08-12T03:51:43.086841229Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
HAX CMS' application pages are vulnerable to clickjacking
Details

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8.

Database specific 
{
    "cwe_ids": [
        "CWE-1021"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54139.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/haxtheweb/haxcms-nodejs

Affected ranges

Type
GIT
Repo
https://github.com/haxtheweb/haxcms-nodejs
Events
Introduced
d03eaf21de065a264dca98cf7a55c4716502de87
Fixed
28435994e3b0ab1eea296407b38180899176642d
Fixed
777f9a7ff9675a160496f350d766df1f1f9b9b99
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:psu:haxcms-nodejs:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "11.0.6"
        },
        {
            "fixed": "11.0.13"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/haxtheweb/haxcms-php
Events
Introduced
557c8ca02fe349c8e590d83e7310b34832ff3e38
Fixed
884d657da648753dcc4b1a8222bfb8e49b476634
Fixed
708dc8518928fe307044e67bff8b0f397cfdd606
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.0.8"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

11.*
11.0.0
v11.*
v11.0.0
v11.0.1
v11.0.10
v11.0.11
v11.0.12
v11.0.5
v11.0.6
v11.0.7
v11.0.8
v11.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54139.json"