Known Vulnerabilities for products from Lavalite
Listed below are 17 of the newest known vulnerabilities associated with the vendor "Lavalite".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2025-71177 json | LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation ... | Not Provided | 2026-01-23 | 2026-07-14 |
| CVE-2023-36984 json | LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. | 7.5 - HIGH | 2023-08-01 | 2023-08-04 |
| CVE-2023-36983 json | LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. | 7.5 - HIGH | 2023-08-01 | 2023-08-04 |
| CVE-2023-30124 json | LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS). | 5.4 - MEDIUM | 2023-05-18 | 2023-05-25 |
| CVE-2023-27238 json | LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. | 9.8 - CRITICAL | 2023-05-12 | 2023-05-22 |
| CVE-2023-27237 json | LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack. | Not Provided | 2023-05-12 | 2026-07-09 |
| CVE-2022-42188 json | In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on ... | 7.5 - HIGH | 2022-10-18 | 2022-10-20 |
| CVE-2020-36397 json | A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authentica... | 5.4 - MEDIUM | 2021-07-02 | 2021-07-06 |
| CVE-2020-36396 json | A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated a... | 5.4 - MEDIUM | 2021-07-02 | 2021-07-06 |
| CVE-2020-36395 json | A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated at... | 5.4 - MEDIUM | 2021-07-02 | 2021-07-06 |
| CVE-2020-28124 json | Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field. | 5.4 - MEDIUM | 2021-04-14 | 2021-04-19 |
| CVE-2020-23700 json | Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature. | 4.8 - MEDIUM | 2021-07-07 | 2021-07-12 |
| CVE-2020-23234 json | Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by us... | 4.8 - MEDIUM | 2021-07-26 | 2021-07-30 |
| CVE-2019-18883 json | XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field. | 6.1 - MEDIUM | 2019-11-13 | 2019-11-14 |
| CVE-2019-17434 json | LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen. | 5.4 - MEDIUM | 2019-10-10 | 2019-10-10 |
| CVE-2018-16551 json | LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit. | 5.4 - MEDIUM | 2018-09-05 | 2019-10-15 |
| CVE-2017-1000467 json | LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can r... | 5.4 - MEDIUM | 2018-01-03 | 2018-01-17 |
Known software with vulnerabilities from Lavalite
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Lavalite | Lavalite | 5.0.0 |