CVE-2025-54139

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8.

• CWE-1021

• https://github.com/haxtheweb/haxcms-nodejs/commit/777f9a7ff9675a160496f350d766df1f1f9b9b99Patch
• https://github.com/haxtheweb/haxcms-php/commit/708dc8518928fe307044e67bff8b0f397cfdd606Patch
• https://github.com/haxtheweb/issues/security/advisories/GHSA-54vw-f4xf-f92jExploit, Third Party Advisory
• https://github.com/haxtheweb/issues/security/advisories/GHSA-54vw-f4xf-f92jExploit, Third Party Advisory

Published

Jul 23, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54133Cursor is a code editor built for programming with AI. In ve…9.6
• CVE-2025-54134HAX CMS NodeJs allows users to manage their microsite univer…6.5
• CVE-2025-54135Cursor is a code editor built for programming with AI. Curso…9.8
• CVE-2025-54136Cursor is a code editor built for programming with AI. In ve…8.8
• CVE-2025-54137HAX CMS NodeJS allows users to manage their microsite univer…7.3
• CVE-2025-54138LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…7.5
• CVE-2025-54140pyLoad is a free and open-source Download Manager written in…7.5
• CVE-2025-54141ViewVC is a browser interface for CVS and Subversion version…7.5
• CVE-2025-54142Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling…4
• CVE-2025-54143Sandboxed iframes on webpages could potentially allow downlo…9.8
• CVE-2025-54144The URL scheme used by Firefox to facilitate searching of te…5.4
• CVE-2025-54145The QR scanner could allow arbitrary websites to be opened i…9.1