{"cve":"CVE-2025-54134","nvd":{"published":"2025-07-21T21:15:26.863","modified":"2026-06-17T09:39:30.753","status":"Analyzed","description":"HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-20","CWE-248","CWE-703"],"references":["https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22","https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/saveFile.js#L52","https://github.com/haxtheweb/haxcms-nodejs/commit/e9773d1996233f9bafb06832b8220ec2a98bab34","https://github.com/haxtheweb/issues/security/advisories/GHSA-pjj3-j5j6-qj27"],"products":["psu:haxcms-nodejs"],"source":"nvd","synced_at":"2026-10-19T22:05:46.678065081+00:00"},"epss":{"cve":"CVE-2025-54134","score":0.00472,"percentile":0.40802,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pjj3-j5j6-qj27","url":"https://osv.dev/vulnerability/GHSA-pjj3-j5j6-qj27","summary":"HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service","modified":"2025-07-21T22:21:29Z","packages":[{"ecosystem":"npm","name":"@haxtheweb/haxcms-nodejs","purl":"pkg:npm/%40haxtheweb/haxcms-nodejs","ranges":["<11.0.9"],"fixed":["11.0.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}