CVE-2025-49139 @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
An authenticated attacker can create a malicious site with an iframe to phish credentials from other users visiting the site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-49139?
CVE-2025-49139 is a medium-severity vulnerability in haxtheweb issues, published on 9 Jun 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is visited, the client's browser will query the supplied URL. An authenticated attacker can create a HAX site with a website block pointing at an attacker-controlled server running Responder or a similar tool. The attacker can then conduct a phishing attack by convincing another user to visit their malicious HAX site to harvest credentials. Version 11.0.0 contains a patch for the issue.
Weakness: CWE-1021
Which versions are affected by CVE-2025-49139?
2 open source packages ship an affected version, including @haxtheweb/haxcms-nodejs. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@haxtheweb/haxcms-nodejs npm | All versions | 11.0.0 |
@haxtheweb/haxcms-nodejs npm | All versions | 11.0.0 |
Products include Psu Haxcms-Nodejs, Psu Haxcms-Php.
How do I fix CVE-2025-49139?
Upgrade @haxtheweb/haxcms-nodejs to 11.0.0 or later.
Is CVE-2025-49139 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-49139 exists.
Other vulnerabilities in haxtheweb issues
- CVE-2025-54127 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
- CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability
- CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability
- CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks
- CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
Sources
Also known as GHSA-v3ph-2q5q-cg88.