Skip to content
OpenAdvisories

Package · Packagist

lavalite/cms

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 5.1
    CVE-2025-71177

    LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search

    LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is …

    lavalite LavaLite CMS lavalite/cms Packagist
  • Medium 6.1
    CVE-2024-31828

    Lavalite CMS Cross Site Scripting vulnerability

    Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2023-30124

    LavaLite vulnerable to Cross Site Scripting

    LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).

    lavalite/cms Packagist
  • Medium 6.1
    CVE-2023-27237

    LavaLite CMS vulnerable to host header injection attack

    LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.

    lavalite/cms Packagist
  • Medium 4.8
    CVE-2020-23234

    Cross Site Scripting in LavaLite CMS

    Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".

    lavalite/cms Packagist
  • Medium 4.8
    CVE-2020-23700

    Cross-site scripting in LavaLite-CMS

    Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2020-36397

    LavaLite Stored Cross-site Scripting vulnerability

    A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2020-36396

    Stored XSS in LavaLite 5.8.0

    A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2020-36395

    Stored XSS in LavaLite 5.8.0

    A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2020-28124

    Cross Site Scripting (XSS) in LavaLite 5.8.0

    Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2018-16551

    Stored XSS in LavaLite 5.5

    LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2017-1000467

    Stored XSS in LavaLite 5.2.4

    LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.

    lavalite/cms Packagist