ZeroDay Findings
Sign inSign up

Findings

CVE-2026-35185

HAX CMS helps manage microsite universe with PHP or NodeJs backends.

Published Apr 6, 2026 · updated Jul 24, 2026 · psu haxiam

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 6, 2026 · NIST NVD

    Detected

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure in

  2. Jul 24, 2026 · NIST NVD

    Updated

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure in

Affected

  • cpe psu/haxiam11.0.5

Sources

  • CVE.orgVulnerability recordCVE-2026-35185

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-35185

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration de

    nvd.nist.gov

References