Skip to content
OpenAdvisories

Vendor

lavalite

3 known vulnerabilities.

Products

cms 2 LavaLite CMS 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-108951

    LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

    LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update …

    lavalite cms
  • Medium 5.1
    CVE-2025-71177

    LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search

    LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is …

    lavalite LavaLite CMS lavalite/cms Packagist