VulnSocial

CVE-2026-48527Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-29: 1Technical Details · 2026-05-29: 105-29
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • DailyCVE@dailycve
    Disclosure

    🔴 HaxCMS (Nodejs / PHP), Stored Cross-Site Scripting (XSS), #CVE-2026-48527 (High) -DC-May2026-46 https://dailycve.com/haxcms-nodejs-php-stored-cross-site-scripting-xss-cve-2026-48527-high-dc-may2026-46/

    Post summary

    A new high‑severity stored XSS vulnerability (CVE‑2026‑48527) in HaxCMS (Node.js/PHP) is disclosed, with a reference link, but no exploit, mitigation, or active‑exploitation details are offered.

    0000051
    207 followersView on X

Explore more

Back to dashboard