HAX CMS contains a Cross-Site Scripting (XSS) vulnerability that could allow an authenticated attacker with low privileges to execute arbitrary scripts in the context of other users' sessions.

This vulnerability is a Cross-Site Scripting (XSS) flaw (CWE-79) triggered by improper input sanitization. The CVSS vector (PR:L/UI:R) indicates that successful exploitation requires an authenticated attacker to trick a user into interacting with the malicious payload.

Successful exploitation allows an attacker to inject malicious scripts, potentially leading to unauthorized session manipulation, data theft, or defacement of the microsite environment. While the CVSS score of 8.7 reflects a high-severity risk, the requirement for user interaction and authentication slightly tempers the immediate threat compared to unauthenticated remote code execution.

Immediate Action: Update haxcms-nodejs to version 26.0.1 or higher and haxcms-php to version 26.0.2 or higher.

Proactive Monitoring: Monitor application logs for unusual script injections or unexpected redirects originating from the CMS interface.

Compensating Controls: Implement or tune a Web Application Firewall (WAF) to detect and block common XSS attack patterns in incoming HTTP requests.

Public Exploit Available: Unknown

Given the potential for session compromise and the presence of a proof-of-concept, administrators should prioritize updating to the patched versions immediately. If an update cannot be deployed immediately, restrict administrative access to trusted users to reduce the attack surface.