psu records

15 published records for vendor psu.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

15 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2025-32028No exploit	HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Executionpsu · haxcms-php · CWE-434 RCE File upload	Critical9.9	—	2.0%	Apr 8, 2025
37Monitor	CVE-2025-54127No exploit	HAXcms's Insecure Default Configuration Leads to Unauthenticated Accesspsu · haxcms-nodejs · CWE-1188 Pre-auth Auth bypass	Critical9.3	—	0.4%	Jul 21, 2025
35Monitor	CVE-2025-49141No exploit	HaxCMS-PHP Command Injection Vulnerabilitypsu · haxcms-nodejs · CWE-78 RCE Command injection	High8.8	—	1.5%	Jun 9, 2025
34Monitor	CVE-2026-35185No exploit	HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addressespsu · haxiam · CWE-284 Pre-auth Broken access control (IDOR)	High8.7	—	0.5%	Apr 6, 2026
33Monitor	CVE-2025-54378No exploit	HAX CMS Backend Lacks Comprehensive Authorization Checkspsu · haxcms-nodejs · CWE-285 Broken access control (IDOR)	High8.3	—	0.5%	Jul 26, 2025
29Monitor	CVE-2025-54137No exploit	NodeJS version of the HAX CMS application is distributed with Default Secretspsu · haxcms-nodejs · CWE-1392 Pre-auth Hard-coded credentials	High7.3	—	0.3%	Jul 22, 2025
28Monitor	CVE-2025-54134No exploit	HAX CMS NodeJs's Improper Error Handling Leads to Denial of Servicepsu · haxcms-nodejs · CWE-20	High7.1	—	0.4%	Jul 21, 2025
28Monitor	CVE-2025-54128No exploit	HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scriptingpsu · haxcms-nodejs · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Jul 21, 2025
26Monitor	CVE-2025-49138No exploit	HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameterpsu · haxcms-php · CWE-22 Path traversal	Medium6.5	—	0.5%	Jun 9, 2025
26Monitor	CVE-2025-49139No exploit	@haxtheweb/haxcms-nodejs Iframe Phishing vulnerabilitypsu · haxcms-nodejs · CWE-1021 Pre-auth	Medium6.5	—	0.4%	Jun 9, 2025
26Monitor	CVE-2025-53642No exploit	haxcms-nodejs and haxcms-php Improperly Terminate Sessionspsu · haxcms-nodejs · CWE-613 Pre-auth	Medium6.5	—	0.2%	Jul 11, 2025
24Monitor	CVE-2025-54139No exploit	HAX CMS' application pages are vulnerable to clickjackingpsu · haxcms-nodejs · CWE-1021 Pre-auth	Medium6.1	—	0.3%	Jul 22, 2025
24Monitor	CVE-2025-49137No exploit	Hax CMS Stored Cross-Site Scripting vulnerabilitypsu · haxcms-nodejs · CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	Jun 9, 2025
21Monitor	CVE-2026-22704Proof of concept	HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeoverpsu · haxcms-nodejs · CWE-79 XSS	Medium5.4	—	1.0%	Jan 10, 2026
17Monitor	CVE-2025-54129No exploit	HAXiam allows for User Enumerationpsu · haxiam · CWE-204	Medium4.3	—	0.3%	Jul 21, 2025

CVE-2025-32028
40Plan
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
CriticalCVSS 9.9No exploitEPSS 2%
- RCE
- File upload
psu · haxcms-phpApr 8, 2025
CVE-2025-54127
37Monitor
HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
psu · haxcms-nodejsJul 21, 2025
CVE-2025-49141
35Monitor
HaxCMS-PHP Command Injection Vulnerability
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
psu · haxcms-nodejsJun 9, 2025
CVE-2026-35185
34Monitor
HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
psu · haxiamApr 6, 2026
CVE-2025-54378
33Monitor
HAX CMS Backend Lacks Comprehensive Authorization Checks
HighCVSS 8.3No exploitEPSS 1%
- Broken access control (IDOR)
psu · haxcms-nodejsJul 26, 2025
CVE-2025-54137
29Monitor
NodeJS version of the HAX CMS application is distributed with Default Secrets
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
psu · haxcms-nodejsJul 22, 2025
CVE-2025-54134
28Monitor
HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
HighCVSS 7.1No exploitEPSS 0%
psu · haxcms-nodejsJul 21, 2025
CVE-2025-54128
28Monitor
HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
psu · haxcms-nodejsJul 21, 2025
CVE-2025-49138
26Monitor
HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter
MediumCVSS 6.5No exploitEPSS 1%
- Path traversal
psu · haxcms-phpJun 9, 2025
CVE-2025-49139
26Monitor
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
psu · haxcms-nodejsJun 9, 2025
CVE-2025-53642
26Monitor
haxcms-nodejs and haxcms-php Improperly Terminate Sessions
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
psu · haxcms-nodejsJul 11, 2025
CVE-2025-54139
24Monitor
HAX CMS' application pages are vulnerable to clickjacking
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
psu · haxcms-nodejsJul 22, 2025
CVE-2025-49137
24Monitor
Hax CMS Stored Cross-Site Scripting vulnerability
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
psu · haxcms-nodejsJun 9, 2025
CVE-2026-22704
21Monitor
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
MediumCVSS 5.4Proof of conceptEPSS 1%
- XSS
psu · haxcms-nodejsJan 10, 2026
CVE-2025-54129
17Monitor
HAXiam allows for User Enumeration
MediumCVSS 4.3No exploitEPSS 0%
psu · haxiamJul 21, 2025