Skip to content
Noroxi

lavalite records

19 published records for vendor lavalite.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
10.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 23
  6. 24
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

19 records
  • CVE-2023-27238
    39Monitor

    LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.

    CriticalCVSS 9.8No exploitEPSS 0%

    lavalite · lavaliteMay 12, 2023

  • CVE-2025-70866
    35Monitor

    LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control.

    HighCVSS 8.8No exploitEPSS 0%

    lavalite · lavaliteFeb 13, 2026

  • CVE-2022-42188
    30Monitor

    In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

    HighCVSS 7.5No exploitEPSS 1%

    lavalite · lavaliteOct 18, 2022

  • CVE-2023-36984
    30Monitor

    LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

    HighCVSS 7.5No exploitEPSS 0%

    lavalite · lavaliteJul 31, 2023

  • CVE-2023-36983
    30Monitor

    LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

    HighCVSS 7.5No exploitEPSS 0%

    lavalite · lavaliteJul 31, 2023

  • CVE-2019-18883
    24Monitor

    XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.

    MediumCVSS 6.1No exploitEPSS 0%

    lavalite · lavaliteNov 13, 2019

  • CVE-2023-27237
    24Monitor

    LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.

    MediumCVSS 6.1No exploitEPSS 0%

    lavalite · lavaliteMay 12, 2023

  • CVE-2024-31828
    24Monitor

    Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via

    MediumCVSS 6.1No exploitEPSS 0%

    lavalite · lavaliteApr 26, 2024

  • CVE-2017-1000467
    21Monitor

    LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disrup

    MediumCVSS 5.4No exploitEPSS 0%

    lavalite · lavaliteJan 3, 2018

  • CVE-2018-16551
    21Monitor

    LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.

    MediumCVSS 5.4No exploitEPSS 0%

    lavalite · lavaliteSep 5, 2018

  • CVE-2019-17434
    21Monitor

    LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.

    MediumCVSS 5.4No exploitEPSS 0%

    lavalite · lavaliteOct 10, 2019

  • CVE-2020-28124
    21Monitor

    Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.

    MediumCVSS 5.4No exploitEPSS 0%

    lavalite · lavaliteApr 14, 2021

  • CVE-2020-36397
    21Monitor

    A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers t

    MediumCVSS 5.4No exploitEPSS 0%

    lavalite · lavaliteJul 2, 2021

  • CVE-2020-36395
    21Monitor

    A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to exec

    MediumCVSS 5.4No exploitEPSS 0%

    lavalite · lavaliteJul 2, 2021

  • CVE-2020-36396
    21Monitor

    A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to exe

    MediumCVSS 5.4No exploitEPSS 0%

    lavalite · lavaliteJul 2, 2021

  • CVE-2023-30124
    21Monitor

    LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).

    MediumCVSS 5.4No exploitEPSS 0%

    lavalite · lavaliteMay 17, 2023

  • CVE-2025-71177
    20Monitor

    LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search

    MediumCVSS 5.1No exploitEPSS 0%

    lavalite · lavaliteJan 23, 2026

  • CVE-2020-23234
    19Monitor

    Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event

    MediumCVSS 4.8No exploitEPSS 0%

    lavalite · lavaliteJul 26, 2021

  • CVE-2020-23700
    19Monitor

    Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.

    MediumCVSS 4.8No exploitEPSS 0%

    lavalite · lavaliteJul 7, 2021