{"id":"EUVD-2026-33286","enisaUuid":"40eb2b05-4454-38e5-9b27-27cf6ee0ee86","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue.","datePublished":"May 29, 2026, 12:26:07 PM","dateUpdated":"May 29, 2026, 1:02:50 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/haxtheweb/issues/security/advisories/GHSA-g2g8-95qg-v35h\n","aliases":"CVE-2026-48527\nGHSA-g2g8-95qg-v35h\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"9d30e1c5-57ee-3357-bc92-a4e9bb6f4c3f","product":{"name":"haxcms-nodejs","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.1"},{"id":"a2445a1c-6c84-329e-8d6c-6f7613944ad8","product":{"name":"haxcms-php","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.2"}],"enisaIdVendor":[{"id":"90da938a-f3cd-3b65-b115-3a62ddfadc43","vendor":{"name":"haxtheweb"}}],"enisaIdVulnerability":[{"id":"1f8fc61f-5431-35e6-bf8b-7dcfd8853ad9","vulnerability":{"id":"GHSA-g2g8-95qg-v35h","description":"HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint","datePublished":"May 29, 2026, 2:07:51 PM","dateUpdated":"Jun 9, 2026, 10:27:09 AM","baseScore":0.0,"references":"https://github.com/haxtheweb/issues/security/advisories/GHSA-g2g8-95qg-v35h\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48527\nhttps://github.com/haxtheweb/issues\n","enisa_id":"EUVD-2026-33286\n","aliases":"CVE-2026-48527\nGHSA-g2g8-95qg-v35h\n","epss":0.0,"dataProcessed":"Nov 15, 2026, 2:50:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"71ff61d6-6e03-367a-a1e9-68420cdab6fe","vulnerability":{"id":"CVE-2026-48527","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue.","datePublished":"May 29, 2026, 12:26:07 PM","dateUpdated":"May 29, 2026, 1:02:50 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/haxtheweb/issues/security/advisories/GHSA-g2g8-95qg-v35h\n","enisa_id":"EUVD-2026-33286\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Nov 15, 2026, 7:23:04 AM","vulnerabilityProduct":[{"id":"946dfc2c-2356-37db-a54d-165718a5f120","product":{"name":"haxcms-nodejs","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.1"},{"id":"c5a77dac-a175-3ba0-92f1-74d6320d813c","product":{"name":"haxcms-php","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.2"}],"vulnerabilityVendor":[{"id":"88bd6e98-c835-36e3-a3d1-6b33a5a34bc1","vendor":{"name":"haxtheweb"}}]}}],"enisaIdAdvisory":[]}