CVE-2025-54129 HAXiam allows for User Enumeration
An authenticated attacker can enumerate valid user accounts by observing HTTP response codes, facilitating targeted attacks against the HAXiam platform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54129?
CVE-2025-54129 is a medium-severity vulnerability in haxtheweb issues, published on 21 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be used to infer the existence of valid user accounts. An authenticated attacker can use automated tooling to brute force potential usernames and use the application's response to identify valid accounts. This can be used in conjunction with other vulnerabilities, such as the lack of authorization checks, to enumerate and deface another user's sites. This is fixed in version 11.0.5.
Weakness: CWE-204
Which versions are affected by CVE-2025-54129?
It affects 1 product.
Products include Psu Haxiam.
How do I fix CVE-2025-54129?
No fix has been published for CVE-2025-54129 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-54129 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54129 exists.