Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

Description

An unauthenticated information disclosure vulnerability exists in the PSU deployment of HAX CMS via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues (e.g.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 10.0.1

References

• GHSA-fvx2-x7ff-fc56
• CVE-2025-48996
• CWE-201
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API - CVE-2025-67419
• evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API - CVE-2025-67427
• jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
• React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button - CVE-2025-3191

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@haxtheweb/open-apis