GitHub Advisoryadvisory · npm, Packagist

GHSA-54vw-f4xf-f92j HAX CMS application pages vulnerable to clickjacking

MEDIUM Published 2025-07-21 Modified 2025-07-23 Official page ↗
Aliases
CVE-2025-54139
Ecosystem
npm, Packagist
Packages
@haxtheweb/haxcms-nodejs, elmsln/haxcms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-1021
Reviewed
2025-07-21

Affected packages

• npm @haxtheweb/haxcms-nodejs: < 11.0.13 → fixed in 11.0.13 • Packagist elmsln/haxcms: < 11.0.8 → fixed in 11.0.8

Description

Summary All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites. PoC To replicate this vulnerability, load the target page in an iframe and observe the rendered content. Impact An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Related

Alias · CVE (1)

  • CVE-2025-54139 HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. vulnerability

Weakness · CWE (1)

  • CWE-1021 Improper Restriction of Rendered UI Layers or Frames weakness

References