CVE-2025-49137
BaseFortify
Publication date: 2025-06-09
Last updated on: 2025-07-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| psu | haxcms-nodejs | to 11.0.0 (exc) |
| psu | haxcms-php | to 11.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-87 | The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax. |
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can lead to the execution of arbitrary JavaScript code in the context of the affected site, potentially allowing attackers to steal sensitive information, hijack user sessions, perform actions on behalf of users, or deface the site. Because the vulnerability allows cross-site scripting, it can compromise the confidentiality and integrity of user data and the application.
What immediate steps should I take to mitigate this vulnerability?
Upgrade HAX CMS to version 11.0.0 or later, as this version fixes the issue by properly sanitizing user input to prevent arbitrary JavaScript execution.
Can you explain this vulnerability to me?
This vulnerability in HAX CMS PHP prior to version 11.0.0 allows attackers to execute arbitrary JavaScript code because the application does not sufficiently sanitize user input. Specifically, the 'saveNode' and 'saveManifest' endpoints accept user input that is stored in the site's JSON schema and later rendered in the generated site. While the application blocks the use of <script> tags, it permits other HTML tags that can run JavaScript, leading to cross-site scripting (XSS) attacks. Version 11.0.0 fixes this issue.