CVE-2025-54128 | haxtheweb haxcms up to 11.0.7 Content Security Policy app.js contentSecurityPolicy cross site scripting

A vulnerability, which was classified as problematic, was found in haxtheweb haxcms up to 11.0.7. Affected is an unknown function of the file app.js of the component Content Security Policy Handler. The manipulation of the argument contentSecurityPolicy leads to cross site scripting.

This vulnerability is traded as CVE-2025-54128. It is possible to launch the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.