4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54139

CVE-2025-54139: HAX CMS application pages vulnerable to clickjacking

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54139

CVE-2025-54139:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@haxtheweb/haxcms-nodejs	npm	< 11.0.13	11.0.13
elmsln/haxcms	composer	< 11.0.8	11.0.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic clickjacking (UI Redressing) weakness, categorized under CWE-1021. It stems from the HAX CMS application's failure to send an appropriate Content-Security-Policy (CSP) frame-ancestors or X-Frame-Options header. This allows an attacker to embed the HAX CMS pages in an <iframe> on a malicious site, potentially tricking users into performing actions they did not intend to.

The patches address this by adding the necessary headers at the application entry points:

For haxcms-nodejs: The fix is in src/app.js, where the helmet security middleware is configured. The frame-ancestors: 'self' directive is added to the CSP, ensuring that only pages from the same origin can frame the application. This is a configuration change that affects the entire application's response headers.
For haxcms-php: The fix is in index.php, the main entry point for the PHP version. A header("Content-Security-Policy: frame-ancestors 'none'"); line is added, which completely disallows any framing of the application pages.

The vulnerability is not located in a single, specific function but is a system-wide security misconfiguration in the application's response headers. The identified 'vulnerable functions' represent the global scope or setup routines where this crucial security configuration was missing and subsequently fixed. Any page rendered by the application would have appeared in a runtime profile during exploitation, as the vulnerability is the successful rendering of the page within a malicious iframe.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-54139: HAX CMS application pages vulnerable to clickjacking

Summary

PoC

Impact

CVE-2025-54139:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

4.3

4.3

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-54139: HAX CMS application pages vulnerable to clickjacking

Summary

PoC

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI