CVE-2025-54129
Last modified
CVE-2025-54129 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be used to infer the existence of valid user accounts. An authenticated attacker can use automated tooling to brute force potential usernames and use the application's response to identify valid accounts. This can be used in conjunction with other vulnerabilities, such as the lack of authorization checks, to enumerate and deface another user's sites. This is fixed in version 11.0.5.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Psu | Haxiam | < 11.0.5 |
References
- https://github.com/haxtheweb/issues/security/advisories/GHSA-wh3h-vfcv-m5g5Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-54129?
How severe is CVE-2025-54129?
How do I fix CVE-2025-54129?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54123Hoverfly is an open source API simulation tool. In versions …9.8
- CVE-2025-54124XWiki Platform is a generic wiki platform offering runtime s…6.5
- CVE-2025-54125XWiki Platform is a generic wiki platform offering runtime s…6.5
- CVE-2025-54126The WebAssembly Micro Runtime's (WAMR) iwasm package is the …5.3
- CVE-2025-54127HAXcms with nodejs backend allows users to start the server …9.8
- CVE-2025-54128HAX CMS NodeJs allows users to manage their microsite univer…6.1
- CVE-2025-54130Cursor is a code editor built for programming with AI. Curso…9.8
- CVE-2025-54131Cursor is a code editor built for programming with AI. In ve…8.8
- CVE-2025-54132Cursor is a code editor built for programming with AI. In ve…7.5
- CVE-2025-54133Cursor is a code editor built for programming with AI. In ve…9.6
- CVE-2025-54134HAX CMS NodeJs allows users to manage their microsite univer…6.5
- CVE-2025-54135Cursor is a code editor built for programming with AI. Curso…9.8
Are you affected by CVE-2025-54129?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST