CVE Tools
Track your stack

Lavalite/cms

14 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Lavalite/cms, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Lavalite/cms CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Lavalite/cms CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-011
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-100

Severity

How the 14 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical17%
  • High17%
  • Medium1286%

Latest CVEs

The 14 most recently published vulnerabilities affecting Lavalite/cms.

  1. CVE-2025-71177LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search5.4
  2. CVE-2024-31828Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.6.1
  3. CVE-2023-30124LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).5.4
  4. CVE-2023-27238LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.9.8
  5. CVE-2023-27237LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.6.1
  6. CVE-2022-42188In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.7.5
  7. CVE-2020-23234Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".4.8
  8. CVE-2020-23700Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.4.8
  9. CVE-2020-36397A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pay...5.4
  10. CVE-2020-36396A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload ...5.4
  11. CVE-2020-36395A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload e...5.4
  12. CVE-2020-28124Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.5.4
  13. CVE-2018-16551LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.5.4
  14. CVE-2017-1000467LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.5.4

Product grouping is registry-driven, with AI assist and human review. How it works