CVE Tools
Track your stack

Lavalite

5 CVEs tracked since 2021. Since Jul 2021, none of them reached CISA KEV.

Lavalite CVEs per month

Jul 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Lavalite CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-0750
2021-083 or fewer
2021-092 or fewer
2021-102 or fewer
2021-112 or fewer
2021-122 or fewer
2022-012 or fewer
2022-022 or fewer
2022-033 or fewer
2022-043 or fewer
2022-053 or fewer
2022-063 or fewer
2022-073 or fewer
2022-083 or fewer
2022-093 or fewer
2022-102 or fewer
2022-113 or fewer
2022-123 or fewer
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Lavalite's monthly top three, with their CVEs summed over those months.

  1. Lavalite51 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Lavalite.

  1. CVE-2026-113358LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes7.5
  2. CVE-2026-108951LavaLite CMS through 10.1.2 Authorization Bypass via User Update API6.5
  3. CVE-2025-70866LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. ...8.8
  4. CVE-2025-71177LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search5.4
  5. CVE-2024-31828Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.6.1
  6. CVE-2023-36984LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.7.5
  7. CVE-2023-36983LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.7.5
  8. CVE-2023-30124LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).5.4
  9. CVE-2023-27238LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.9.8
  10. CVE-2023-27237LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.6.1
  11. CVE-2022-42188In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.7.5
  12. CVE-2020-23234Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".4.8
  13. CVE-2020-23700Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.4.8
  14. CVE-2020-36397A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pay...5.4
  15. CVE-2020-36396A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload ...5.4

The record

Peak rank
#90 in Jul 2021
Busiest month shown
Jul 2021, 5 CVEs
Months with a KEV entry
0 since Jul 2021
Monthly snapshots
1 since 2021
Lavalite's full record, month by month