HarborGuard / CVE
Back to search
HIGHCVE-2026-22704Published Modified CNA GitHub_M

CVE-2026-22704: HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.

Metrics

CVSS v3.1
8.1
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • haxtheweb / issues
    >= 11.0.6, < 25.0.0
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
References
CVE-2026-22704: HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover | HarborGuard CVE