CVE-2025-54128
Last modified
CVE-2025-54128 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js. This is fixed in version 11.0.8.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Psu | Haxcms-Nodejs | < 11.0.8 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-54128?
How severe is CVE-2025-54128?
How do I fix CVE-2025-54128?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54122Manager-io/Manager is accounting software. A critical unauth…10
- CVE-2025-54123Hoverfly is an open source API simulation tool. In versions …9.8
- CVE-2025-54124XWiki Platform is a generic wiki platform offering runtime s…6.5
- CVE-2025-54125XWiki Platform is a generic wiki platform offering runtime s…6.5
- CVE-2025-54126The WebAssembly Micro Runtime's (WAMR) iwasm package is the …5.3
- CVE-2025-54127HAXcms with nodejs backend allows users to start the server …9.8
- CVE-2025-54129HAXiam is a packaging wrapper for HAXcms which allows anyone…4.3
- CVE-2025-54130Cursor is a code editor built for programming with AI. Curso…9.8
- CVE-2025-54131Cursor is a code editor built for programming with AI. In ve…8.8
- CVE-2025-54132Cursor is a code editor built for programming with AI. In ve…7.5
- CVE-2025-54133Cursor is a code editor built for programming with AI. In ve…9.6
- CVE-2025-54134HAX CMS NodeJs allows users to manage their microsite univer…6.5
Are you affected by CVE-2025-54128?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST