Vulnerability in Haxtheweb Issues
CVE-2025-54129
HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be used to infer the existence of valid user accounts. An authenticated attacker can use automated tooling to brute force potential usernames and use the application's response to identify valid accounts. This can be used in conjunction with other vulnerabilities, such as the lack of authorization checks, to enumerate and deface another user's sites. This is fixed in version 11.0.5.
EPSS: 0.003 (19.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Haxtheweb Issues — versions < 11.0.5
- Psu Haxiam
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-54129?
- CVE-2025-54129 is a medium-severity vulnerability in Haxtheweb Issues, classified under Observable Response Discrepancy. CVSS score: 4.3/10. Published 2025-07-21.
- How severe is CVE-2025-54129?
- Medium severity. CVSS v3 base score is 4.3 out of 10.
- Is CVE-2025-54129 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.