Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

lavalite/cms

14 known vulnerabilities (1 critical, 1 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 1 critical, 1 high, 4 medium
Registry
Packagist

Advisories 14

  • CVE-2025-71177Medium 5.1

    LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search

    Affected: through 10.1.0.

  • CVE-2024-31828Medium 6.1

    Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information…

    Affected: versions 10.1.0.

  • CVE-2023-30124Medium 5.4

    LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).

    Affected: through 9.0.0.

  • CVE-2023-27238Critical 9.8

    LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.

    Affected: through 9.0.0.

  • CVE-2023-27237Medium 6.1

    LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.

    Affected: through 9.0.0.

  • In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

    Affected: versions 9.0.0.

  • Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML…

    Affected: through 5.8.0.

  • Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.

    Affected: through 5.8.0.

  • A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers…

    Affected: through 5.8.0.

  • A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to…

    Affected: through 5.8.0.

  • A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to…

    Affected: fixed in 5.8.0.

  • Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.

    Affected: fixed in 7.0.1.

  • LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.

    Affected: all versions.

  • LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in…

    Affected: through 5.2.4.