HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p | Exploit Third Party Advisory |
| https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p | Exploit Third Party Advisory |
Configurations
History
30 Jul 2025, 17:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Psu haxcms-php
Psu |
|
| CPE | cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:* | |
| References | () https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p - Exploit, Third Party Advisory |
18 Jun 2025, 13:46
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Haxtheweb hax
Haxtheweb |
|
| CPE | cpe:2.3:a:haxtheweb:hax:*:*:*:*:*:*:*:* | |
| References | () https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p - Third Party Advisory, Exploit |
08 Apr 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
08 Apr 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-08 16:15
Updated : 2025-07-30 17:36
NVD link : CVE-2025-32028
Mitre link : CVE-2025-32028
JSON object : View
Products Affected
psu
- haxcms-php
CWE
No CWE.