CVE-2025-54134CWE-20CWE-248CWE-703

HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service

High · published July 21, 2025

CVSS v4.0
7.1
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00472 · 39.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-248 · Uncaught Exception; CWE-703 · Improper Check or Handling of Exceptional Conditions
Published
2025-07-21T20:58Z
EPSS history
Timeline
  • 21 JUL 20:58Z
    HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
    cvelistv5