CVE Details
Basic Information
| Title | HAX CMS NodeJs’s Disabled Content Security Policy Enables Cross-Site Scripting |
|---|---|
| Type | cve |
| Published | 2025-07-21T20:46:31.660Z |
| Modified | 2025-07-21T20:46:31.660Z |
Product Information
| Vendor | haxtheweb |
|---|---|
| Product | issues |
| Version | < 11.0.8 |
CVSS Information
| Base Score | 7.2 (HIGH) |
|---|---|
| Attack Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N |
Affected Products
- haxtheweb issues < 11.0.8
Additional Information
| CWE List | CWE-79 |
|---|---|
| Source | GitHub_M |
Description
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application’s Helmet configuration in app.js. This is fixed in version 11.0.8.