Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs in the `source` attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more. Version 26.0.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-46496 HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to impro… https://www.cve.org/CVERecord?id=CVE-2026-46496
Post summary
The text announces a stored XSS vulnerability in HAX CMS prior to version 26.0.0, providing affected versions and vulnerability type.
CVE-2026-46496 Stored Cross-Site Scripting in HAX CMS Versions Prior to 26.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-46496
Post summary
The post identifies a stored XSS vulnerability in HAX CMS versions older than 26.0.0, providing the CVE ID and a link, but offers no proof of exploitation, exploit code, or patch information.