Lavalite vulnerabilities

Products

• Lavalite 19
• Cms 3

Newest

• lavalite cms LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes CVE-2026-113358 8.7 HighOctober 20, 2026
• lavalite cms LavaLite CMS through 10.1.2 Authorization Bypass via User Update API CVE-2026-108951 7.1 HighOctober 12, 2026
• lavalite LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low... CVE-2025-70866 8.8 HighFebruary 13, 2026
• lavalite, lavalite cms +1 more LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search CVE-2025-71177 5.1 MediumJanuary 23, 2026
• lavalite cms, lavalite +1 more Lavalite CMS Cross Site Scripting vulnerability CVE-2024-31828 6.1 MediumApril 26, 2024
• lavalite LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVE-2023-36984 7.5 HighAugust 1, 2023
• lavalite LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVE-2023-36983 7.5 HighAugust 1, 2023
• lavalite LavaLite vulnerable to Cross Site Scripting CVE-2023-30124 5.4 MediumMay 18, 2023
• lavalite LavaLite vulnerable to web cache poisoning CVE-2023-27238 9.8 CriticalMay 12, 2023
• lavalite LavaLite CMS vulnerable to host header injection attack CVE-2023-27237 6.1 MediumMay 12, 2023
• lavalite Lavalite vulnerable to Arbitrary File Read via Directory Traversal CVE-2022-42188 7.5 HighOctober 18, 2022
• lavalite Cross Site Scripting in LavaLite CMS CVE-2020-23234 4.8 MediumJuly 26, 2021
• lavalite Cross-site scripting in LavaLite-CMS CVE-2020-23700 4.8 MediumJuly 7, 2021
• lavalite LavaLite Stored Cross-site Scripting vulnerability CVE-2020-36397 5.4 MediumJuly 2, 2021
• lavalite Stored XSS in LavaLite 5.8.0 CVE-2020-36396 5.4 MediumJuly 2, 2021
• lavalite Stored XSS in LavaLite 5.8.0 CVE-2020-36395 Fix available 5.4 MediumJuly 2, 2021
• lavalite Cross Site Scripting (XSS) in LavaLite 5.8.0 CVE-2020-28124 Fix available 5.4 MediumApril 14, 2021
• lavalite XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field. CVE-2019-18883 6.1 MediumNovember 13, 2019
• lavalite LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients... CVE-2019-17434 5.4 MediumOctober 10, 2019
• lavalite Stored XSS in LavaLite 5.5 CVE-2018-16551 Fix available 5.4 MediumSeptember 5, 2018
• lavalite Stored XSS in LavaLite 5.2.4 CVE-2017-1000467 5.4 MediumJanuary 3, 2018