Description
haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.
Scores
CVSS v3
4.8
EPSS
0.0004
EPSS Percentile
13.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-613
Status
published
Products (2)
psu/haxcms-nodejs
< 11.0.6
psu/haxcms-php
< 11.0.6
Published
Jul 11, 2025
Tracked Since
Feb 18, 2026