CVE-2025-54129 - CVE House
Back to Database
Status published Medium CVE-2025-54129

HAXiam allows for User Enumeration

Vulnerability Description

HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be used to infer the existence of valid user accounts. An authenticated attacker can use automated tooling to brute force potential usernames and use the application's response to identify valid accounts. This can be used in conjunction with other vulnerabilities, such as the lack of authorization checks, to enumerate and deface another user's sites. This is fixed in version 11.0.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54129

Credits & Attribution

No credits recorded in the NVD database.

References

More from haxtheweb

View All →
CVE-2025-54378
HAX CMS Backend Lacks Comprehensive Authorization Checks
High 8.3
CVE-2025-54139
HAX CMS' application pages are vulnerable to clickjacking
Medium 4.3
CVE-2025-54137
NodeJS version of the HAX CMS application is distributed with Default Secrets
High 7.3
CVE-2025-54134
HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
High 7.1
CVE-2025-54128
HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting
High 7.2

Affected Vendor

Affected Software

issues
Vulnerable Versions:
< 11.0.5

Timeline

Official Publish: July 21st, 2025
Last Modified: July 22nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-204

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.