CVE-2025-49139
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-06-09

Last updated on: 2025-07-30

Assigner: GitHub, Inc.

Description
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is visited, the client's browser will query the supplied URL. An authenticated attacker can create a HAX site with a website block pointing at an attacker-controlled server running Responder or a similar tool. The attacker can then conduct a phishing attack by convincing another user to visit their malicious HAX site to harvest credentials. Version 11.0.0 contains a patch for the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-06-09
Last Modified
2025-07-30
Generated
2026-05-07
AI Q&A
2025-06-10
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
psu haxcms-nodejs to 11.0.0 (exc)
psu haxcms-php to 11.0.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1021 The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in HAX CMS PHP prior to version 11.0.0 allows an authenticated attacker to create a website block that loads an attacker-controlled URL in an iframe. When another user visits the malicious HAX site, their browser queries the attacker-controlled URL, enabling the attacker to conduct phishing attacks and harvest credentials.


How can this vulnerability impact me? :

The vulnerability can lead to phishing attacks where an attacker harvests credentials from users who visit a malicious HAX site. This can compromise user accounts and potentially lead to unauthorized access or data breaches.


What immediate steps should I take to mitigate this vulnerability?

Upgrade HAX CMS to version 11.0.0 or later, as this version contains a patch that fixes the vulnerability. Additionally, restrict or monitor the creation of website blocks that load external URLs in iframes to prevent attackers from embedding malicious sites.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart