CVE-2025-32028
CVSS 3.1 Score 9.9 of 10 (high)
Details
Published Apr 8, 2025
CWE ID 434
Summary
CVE-2025-32028 is a vulnerability affecting HAX CMS PHP, a microsite management system with a PHP backend. The issue lies in the file upload functions, which call a 'save' function in 'HAXCMSFile.php'. This function employs a denylist to prevent specific file types from being uploaded, but it only blocks '.php', '.sh', '.js', and '.css' files. Due to an oversight in logic, the system fails to deny access to unapproved file types, leading to potential security risks. The vulnerability has been rectified in version 10.0.3.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.