XSS in Haxtheweb Haxcms-nodejs

CVE-2026-46511

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated at…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (19.5th percentile) — read the EPSS interpretation.