CVE-2025-54137

HIGH EPSS 23.3%
Published Jul 22, 202511mo ago · Modified Jun 17, 20261w ago
7.3 CVSS 3.1
High
Find Similar
Published Jul 22, 2025 11mo ago
Last Modified Jun 17, 2026 1w ago

Description

HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks. This is fixed in version 11.0.10.

CVSS Details

Base Score
7.3
Exploitability
3.9
Impact
3.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
23.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-1392

Affected Products 1

VendorProductVersionRange
psuhaxcms-nodejs* <11.0.10

References 3

  • github.com https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/lib/HAXCMS.js#L1614
    Product
  • github.com https://github.com/haxtheweb/haxcms-nodejs/commit/6dc2441c876350ca6fe9fbaecb058d92ef442869
    Patch
  • github.com https://github.com/haxtheweb/issues/security/advisories/GHSA-5fpv-5qvh-7cf3
    Third Party Advisory

Remediation

  • github.com https://github.com/haxtheweb/haxcms-nodejs/commit/6dc2441c876350ca6fe9fbaecb058d92ef442869
    Patch