PT-2026-4499 · Unknown · Lavalite Cms

Abigowl · Publicado 2026-01-23 · Atualizado 2026-01-24 · CVE-2025-71177

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LavaLite CMS versions up to and including 10.1.0

Description LavaLite CMS is affected by a stored cross-site scripting issue in the package creation and search functionality. Authenticated users can inject crafted HTML or JavaScript into the Name or Description fields during package creation. This malicious content is stored and subsequently displayed without proper output encoding when other users view package search results, leading to script execution in their browsers. This could allow for session hijacking, credential theft, and unauthorized actions.

Recommendations Versions prior to 10.1.0 should be updated.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-71177

GHSA-W7RQ-FGX4-4XCM

Produtos afetados

Lavalite Cms

Referências · 11

• 🔥 https://github.com/LavaLite/cms/issues/420 · Exploit
• https://github.com/LavaLite/cms · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-71177 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-w7rq-fgx4-4xcm · Aviso do Fabricante
• https://t.me/CVEtracker/42872 · Publicação no Telegram
• https://lavalite.org · Nota
• https://osv.dev/vulnerability/CVE-2025-71177 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2014995847373877492 · Publicação no Twitter
• https://twitter.com/_cvereports/status/2014868326002970915 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2014868219811565878 · Publicação no Twitter
• https://vulncheck.com/advisories/lavalite-cms-stored-xss-via-package-creation-and-search · Nota