[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2025-54128":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":10,"cwes":11,"cpes":13,"technologies":17,"references":20,"score":25,"epss_score":26,"epss_percentile":27,"is_kev":10,"cisa_kev_date_added":28,"cisa_kev_due_date":28,"cisa_ssvc":29,"attack_mappings":39,"exploits":40},63143,"CVE-2025-54128","EUVD-2025-22265","NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting\n\n### Summary\nThe NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks.\n\n### Details\nThe `contentSecurityPolicy` value is explicitly disabled in the application's Helmet configuration in `app.js`.\n\n![permissive-csp-code](https:\u002F\u002Fgithub.com\u002Fuser-attachments\u002Fassets\u002F8ec6c63c-9f9f-413e-be7e-ed14913da91c)\n\n#### Affected Resources\n- [app.js:52](https:\u002F\u002Fgithub.com\u002Fhaxtheweb\u002Fhaxcms-nodejs\u002Fblob\u002Fb1f95880b42fea6ed07855b5804b29b182ec5e07\u002Fsrc\u002Fapp.js#L52)\n\n### PoC\nTo reproduce this vulnerability, [install](https:\u002F\u002Fgithub.com\u002Fhaxtheweb\u002Fhaxcms-nodejs) HAX CMS NodeJS. The application will load without a CSP configured.\n\n### Impact\nIn conjunction with an XSS vulnerability, an attacker could execute arbitrary scripts and exfiltrate data, including session tokens and sensitive local data.\n\n#### Additional Information\n- [OWASP: Content Security Policy](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FContent_Security_Policy_Cheat_Sheet.html)","2025-07-21T19:51:00Z",{},false,[12],"CWE-79",[14,15,16],"cpe:2.3:a:psu:haxcms-nodejs:*:*:*:*:*:node.js:*:*","cpe:2.3:a:haxtheweb:haxcms-nodejs:*:*:*:*:*:*:*:*","cpe:2.3:a:haxtheweb:haxcms-nodejs:11.0.7:*:*:*:*:*:*:*",[18,19],"Psu Haxcms-Nodejs","Haxtheweb Haxcms-Nodejs",[21,22,23,24],"https:\u002F\u002Fgithub.com\u002Fhaxtheweb\u002Fhaxcms-nodejs\u002Fcommit\u002Fddb9351c6d6418008d4084a5b17fd6d611bc4e30","https:\u002F\u002Fgithub.com\u002Fhaxtheweb\u002Fissues\u002Fsecurity\u002Fadvisories\u002FGHSA-59g8-h59f-8hjp","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-54128","https:\u002F\u002Fgithub.com\u002Fhaxtheweb\u002Fhaxcms-nodejs",0,0.0023,0.13737,null,{"timestamp":30,"automatable":31,"tech_impact":32,"exploitation":33,"cisa_decision":34,"cisa_remediation_timeline":38},"2025-07-22T20:43:42.705089Z","no","partial","poc",{"vector":35,"decision":36,"priority":37},"CISAv1\u002FE:P\u002FA:N\u002FT:P\u002FM:H\u002F2026-10-25T18:43:31.963257\u002F","track_star","medium","60D",[],[]]