CVE-2026-46357

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.24% chance of exploitation in the next 30 days, 15th percentile

Published

2026-06-05

Updated

2026-06-09

Proof-of-concept exploits (1)

• advisories/GHSA-9r33-xhw8-4qqp

References

• CVE Record
• NVD entry

Related

• CVE-2026-46345
• CVE-2026-46359
• CVE-2026-46341
• CVE-2026-46360
• CVE-2026-46339
• CVE-2026-46361