CVE-2026-35185

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284 CWE-522 CWE-532

Affected software

Vendor	Product	Versions
haxtheweb	HAXiam	< 25.0.0

References

https://github.com/haxtheweb/issues/security/advisories/GHSA-3676-wj6r-hwh7Exploit, Vendor Advisory
https://github.com/haxtheweb/issues/security/advisories/GHSA-3676-wj6r-hwh7Exploit, Vendor Advisory

Timeline

Published: Apr 6, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-351867.5Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug wh CVE-2026-351877.7pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload CVE-2026-351885.0Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, trigg CVE-2026-351895.3Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL cach CVE-2026-35197.2OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administr CVE-2026-351913.7Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple CVE-2026-351926.5An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but CVE-2026-351933.1An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not CVE-2026-351948.1Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query subm CVE-2026-351955.4Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between CVE-2026-351968.8Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in t CVE-2026-351979.8dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would result in execution