Description
An unauthenticated information disclosure vulnerability exists in the PSU deployment of HAX CMS via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues (e.g.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 10.0.1
References
Could your website be exposed too?
SmartScanner can check your website for Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint and gives you actionable findings to investigate.
Start a free scanRelated Issues
- evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API - CVE-2025-67419
- evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API - CVE-2025-67427
- jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
- React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button - CVE-2025-3191
You might also like:
See something that needs correcting? Let us knowUpdated June 05, 2025