LyLme records
12 published records for vendor lylme.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')6
- CWE-434 Unrestricted Upload of File with Dangerous Type2
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
- CWE-863 Incorrect Authorization1
- CWE-918 Server-Side Request Forgery (SSRF)1
The weakness classes this vendor ships most often: where to look.
CWEAll records
12 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2024-34982Proof of concept | An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code vlylme · lylme spage · CWE-434 | Critical9.8 | — | 4.6% | May 17, 2024 |
39Monitor | CVE-2023-45952No exploit | An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via ulylme · lylme spage · CWE-434 | Critical9.8 | — | 0.9% | Oct 17, 2023 |
39Monitor | CVE-2023-45951No exploit | lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php.lylme · lylme spage · CWE-89 | Critical9.8 | — | 0.8% | Oct 17, 2023 |
39Monitor | CVE-2024-48357No exploit | LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php.lylme · lylme spage · CWE-89 | Critical9.8 | — | 0.5% | Oct 28, 2024 |
39Monitor | CVE-2024-48356No exploit | LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.lylme · lylme spage · CWE-89 | Critical9.8 | — | 0.5% | Oct 28, 2024 |
39Monitor | CVE-2024-48176No exploit | Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control.lylme · lylme spage · CWE-863 | Critical9.8 | — | 0.4% | Nov 5, 2024 |
36Monitor | CVE-2024-36675Proof of concept | LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.lylme · lylme spage · CWE-918 | Critical9.1 | — | 1.4% | Jun 4, 2024 |
27Monitor | CVE-2025-4543No exploit | LyLme Spage ajax_link.php sql injectionlylme · lylme spage · CWE-74 | Medium6.9 | — | 0.5% | May 11, 2025 |
24Monitor | CVE-2024-36674No exploit | LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.lylme · lylme spage · CWE-79 | Medium6.1 | — | 0.3% | Jun 3, 2024 |
20Monitor | CVE-2024-9788No exploit | LyLme_spage tag.php sql injectionlylme · lylme spage · CWE-89 | Medium5.1 | — | 0.5% | Oct 10, 2024 |
20Monitor | CVE-2024-9789No exploit | LyLme_spage apply.php sql injectionlylme · lylme spage · CWE-89 | Medium5.1 | — | 0.5% | Oct 10, 2024 |
20Monitor | CVE-2024-9790No exploit | LyLme_spage sou.php sql injectionlylme · lylme spage · CWE-89 | Medium5.1 | — | 0.5% | Oct 10, 2024 |
- CVE-2024-3498240Plan
An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code v
CriticalCVSS 9.8Proof of conceptEPSS 4%lylme · lylme spageMay 17, 2024
- CVE-2023-4595239Monitor
An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via u
CriticalCVSS 9.8No exploitEPSS 0%lylme · lylme spageOct 17, 2023
- CVE-2023-4595139Monitor
lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php.
CriticalCVSS 9.8No exploitEPSS 0%lylme · lylme spageOct 17, 2023
- CVE-2024-4835739Monitor
LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php.
CriticalCVSS 9.8No exploitEPSS 0%lylme · lylme spageOct 28, 2024
- CVE-2024-4835639Monitor
LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.
CriticalCVSS 9.8No exploitEPSS 0%lylme · lylme spageOct 28, 2024
- CVE-2024-4817639Monitor
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control.
CriticalCVSS 9.8No exploitEPSS 0%lylme · lylme spageNov 5, 2024
- CVE-2024-3667536Monitor
LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.
CriticalCVSS 9.1Proof of conceptEPSS 1%lylme · lylme spageJun 4, 2024
- CVE-2025-454327Monitor
LyLme Spage ajax_link.php sql injection
MediumCVSS 6.9No exploitEPSS 0%lylme · lylme spageMay 11, 2025
- CVE-2024-3667424Monitor
LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.
MediumCVSS 6.1No exploitEPSS 0%lylme · lylme spageJun 3, 2024
- CVE-2024-978820Monitor
LyLme_spage tag.php sql injection
MediumCVSS 5.1No exploitEPSS 0%lylme · lylme spageOct 10, 2024
- CVE-2024-978920Monitor
LyLme_spage apply.php sql injection
MediumCVSS 5.1No exploitEPSS 0%lylme · lylme spageOct 10, 2024
- CVE-2024-979020Monitor
LyLme_spage sou.php sql injection
MediumCVSS 5.1No exploitEPSS 0%lylme · lylme spageOct 10, 2024