{"id":"EUVD-2026-34891","enisaUuid":"8410e6bc-4034-38c4-be66-34e4868b0367","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `\u003ciframe\u003e` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.","datePublished":"Jun 5, 2026, 6:44:28 PM","dateUpdated":"Jun 9, 2026, 2:36:27 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36\n","aliases":"CVE-2026-46396\nGHSA-jh3h-rpxg-fr36\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"18f0b9e5-e3fc-3a3a-9b5a-9189d2e05774","product":{"name":"iframe-loader","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.0"},{"id":"3b864342-93fd-3797-8d4f-0d37dbacbc3e","product":{"name":"haxcms-nodejs","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.0"},{"id":"91ef8b75-a07b-30f4-a7fc-ea10a86d74f5","product":{"name":"video-player","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.0"}],"enisaIdVendor":[{"id":"f354819f-1391-3b75-94c5-480aa44b9237","vendor":{"name":"haxtheweb"}}],"enisaIdVulnerability":[{"id":"657ddcac-0de2-3e7d-9a40-9e6f09122080","vulnerability":{"id":"GHSA-jh3h-rpxg-fr36","description":"Stored XSS via \u003ciframe\u003e in HAX CMS allows access to sensitive client-side data and account takeover","datePublished":"May 19, 2026, 2:46:47 PM","dateUpdated":"Jun 9, 2026, 11:56:54 AM","baseScore":0.0,"references":"https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46396\nhttps://github.com/haxtheweb/issues\n","enisa_id":"EUVD-2026-34891\n","aliases":"GHSA-jh3h-rpxg-fr36\nCVE-2026-46396\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:48:27 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ba5d7c6a-0710-321c-a6b0-abd8307ab0f8","vulnerability":{"id":"CVE-2026-46396","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `\u003ciframe\u003e` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.","datePublished":"Jun 5, 2026, 6:44:28 PM","dateUpdated":"Jun 9, 2026, 2:36:27 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36\n","enisa_id":"EUVD-2026-34891\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Nov 13, 2026, 7:22:46 AM","vulnerabilityProduct":[{"id":"1fcbe464-acb5-3c63-b1b1-1933249f8626","product":{"name":"iframe-loader","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.0"},{"id":"88ad0338-0239-3f7f-aa68-066db392058a","product":{"name":"haxcms-nodejs","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.0"},{"id":"d1a63afa-fca9-3f45-859d-8cbe285f1f9b","product":{"name":"video-player","vendor":{"name":"haxtheweb"}},"product_version":"\u003c 26.0.0"}],"vulnerabilityVendor":[{"id":"c576ff53-1cdf-33ee-8173-8797fdd509f1","vendor":{"name":"haxtheweb"}}]}}],"enisaIdAdvisory":[]}