CVE-2025-54134

Katalog CVE

CVSS 6.5 · Medium EPSS 0,44%

Kerentanan Improper Input Validation pada psu haxcms-nodejs. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.

Rincian

Terbit di NVD

21 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-248: Uncaught Exception
CWE-703: Improper Check or Handling of Exceptional Conditions

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/haxtheweb/haxcms-nodejs/commit/e9773d1996233f9bafb06832b8220ec2a98bab34 patch
• https://github.com/haxtheweb/issues/security/advisories/GHSA-pjj3-j5j6-qj27 advisory pihak ketiga
• https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22 product
• https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/saveFile.js#L52 product