Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.0.0, the file upload functionality in HAXCMS PHP only validates file extensions using a regex pattern without checking the actual file content or MIME type. This allows attackers to upload malicious files (e.g., PHP webshells) disguised as legitimate image files, potentially leading to remote code execution. Version 25.0.0 contains a fix for the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-46400 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.0.0, the file upload functionality in HAXCMS P… https://www.cve.org/CVERecord?id=CVE-2026-46400
Post summary
The text announces CVE‑2026‑46400, describing a flaw in HAXCMS's file‑upload feature, but does not provide evidence of exploitation, PoC, patch, or debunking.
CVE-2026-46400 Arbitrary File Upload Leading to Remote Code Execution in HAX CMS PHP https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-46400
Post summary
The statement identifies CVE‑2026‑46400 as a remote code execution flaw caused by arbitrary file upload in HAX CMS PHP, but it offers no PoC, exploit code, active exploitation evidence, or mitigation details.