Products: 3
Vulnerabilities: 21
Known Exploited: 0
1
Critical Level Threats
5
High Level Threats
15
Medium Level Threats
0
Low Level Threats
Vulnerabilities
100806040200
JanFebMarAprMayJunJulAugSepOctNovDec
Critical Level Threats
High Level Threats
Medium Level Threats
Low Level Threats
Products Security index
Actions
Items Per Page
Vulnerabilities
CVE-2026-113358
LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
Last Modified: Oct 22, 2026
Published: Oct 20, 2026
CVE-2026-108951
LavaLite CMS through 10.1.2 Authorization Bypass via User Update API
Last Modified: Oct 14, 2026
Published: Oct 12, 2026
CVE-2025-70866
LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider without role-based access control verification.
Last Modified: Feb 19, 2026
Published: Feb 13, 2026
CVE-2025-71177
LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search
Last Modified: Mar 05, 2026
Published: Jan 23, 2026
CVE-2024-31828
Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.
Last Modified: Aug 24, 2026
Published: Apr 26, 2024
Items Per Page
