Haxcms — PoC Archivehttps://poc.intelseclab.com/tags/haxcms/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000HAXcms Node.js Private Key Disclosure via Broken HMAC (CVE-2026-46395)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46395-haxcms-hmac-key-leak/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46395-haxcms-hmac-key-leak/Critical severity (CVSS 9.8) — web · CVE-2026-46395. Status: PoC. Affects: HAXcms Node.js backend (elmsln/HAXcms, haxcms-nodejs) — src/lib/HAXCMS.js. Tags: haxcms, nodejs, hmac, jwt-forgery, cwe-321, cwe-200, key-disclosure, cms.webCriticalhaxcmsnodejshmacjwt-forgerycwe-321cwe-200key-disclosurecmsHAXcms Git.php OS Command Injection (CVE-2026-46394)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/High severity (CVSS 7.2) — web · CVE-2026-46394. Status: PoC. Affects: HAXcms PHP backend (elmsln/HAXcms) — system/backend/php/lib/Git.php. Tags: haxcms, php, command-injection, cwe-78, git, proc_open, cms.webHighhaxcmsphpcommand-injectioncwe-78gitproc_opencms@haxtheweb/open-apis Credential Exposure via SSRF in cacheAddress Endpoint (CVE-2026-46391)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46391-haxtheweb-open-apis-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46391-haxtheweb-open-apis-ssrf/High severity — web · CVE-2026-46391 (GHSA-4fg7-f244-3j49). Status: PoC. Affects: @haxtheweb/open-apis (HAXcms/HAX ecosystem web service APIs). Tags: haxtheweb, haxcms, open-apis, ssrf, cwe-918, credential-exposure, cacheaddress.webHighhaxthewebhaxcmsopen-apisssrfcwe-918credential-exposurecacheaddress