ExploitPublished
HAX CMS 24.x - Stored Cross-Site Scripting (XSS)
Source Exploit-DB RSS Feed
0
Severity
MediumRated by Threat Radar
Data as of 5 May 2026, 07:48 UTC
What to do
AI-suggested
Until an official fix is available, users should consider applying input validation and output encoding as temporary mitigations to reduce the risk of stored XSS. Monitor vendor channels for updates and apply patches promptly once released.
Description
HAX CMS 24.x - Stored Cross-Site Scripting (XSS)
Indicators of compromise
Exploit source code
# Exploit Title: HAX CMS 24.x - Stored Cross-Site Scripting (XSS)
# Date: 2026-01-28
# Google Dork: "N/A"
# Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Vendor Homepage: https://www.drupal.org/project/hax
# Software Link: https://github.com/elmsln/haxcms
# Version: <= 24.x (tested)
# Tested on: Linux
# CVE: CVE-2026-22704
#
# Description:
# HAX CMS allows low-privileged authenticated users to upload HTML files
# without proper content sanitization. …References
Community reviews
Loading reviews…