CVE-2025-54128: Psu Haxcms-Node.js

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js. This is fixed in version 11.0.8.

Affected products

• Psu Haxcms-Node.js: before 11.0.8 (fixed in 11.0.8)

Published 2025-07-21. Last modified 2026-06-17.