High severity7.5NVD Advisory· Published Apr 6, 2026· Updated Apr 16, 2026
CVE-2026-35185
CVE-2026-35185
Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/haxtheweb/issues/security/advisories/GHSA-3676-wj6r-hwh7nvdExploitVendor Advisory
News mentions
0No linked articles in our index yet.