HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vul…

HAX CMS versions up to 26.0.0 contain a stored cross-site scripting vulnerability in the /system/api/saveNode endpoint. Authenticated users with page editing permissions can bypass HTML sanitization by injecting event handler attributes without whitespace before the attribute name. This affects both PHP and NodeJs backends. The vulnerability has been patched in haxcms-nodejs 26.0.1 and haxcms-php 26.0.2.