Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Oct 20, 2026LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files tCVE-2026-113358 · Other software · lavalite · reported by VulnCheckHigh 8.7
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 12, 2026LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abuCVE-2026-108951 · Other software · lavalite · reported by VulnCheckHigh 7.1
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control.CVE-2025-70866 · Other software · Lavalite · reported by MITREHigh 8.8
LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider without role-based access control verification.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 23, 2026LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality.CVE-2025-71177 · Other software · LavaLite · reported by VulnCheckMedium 5.1
LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. When other users view search results that include the malicious package, the injected script executes in their browsers, potentially enabling session hijacking, credential theft, and unauthorized actions in the context of the victim.
- Product
- LavaLite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlavalite.org
Apr 26, 2024Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload toCVE-2024-31828 · Other software · lavalite · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjinmu1108.github.iojinmu1108.github.io
Jul 31, 2023LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.CVE-2023-36984 · Other software · Lavalite · reported by MITREHigh 7.5
LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.CVE-2023-36983 · Other software · Lavalite · reported by MITREHigh 7.5
LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).CVE-2023-30124 · Other software · Lavalite · reported by MITREMedium 5.4
LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.CVE-2023-27238 · Other software · Lavalite · reported by MITRECritical 9.8
LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.CVE-2023-27237 · Other software · Lavalite · reported by MITREMedium 6.1
LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2022In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.CVE-2022-42188 · Other software · Lavalite · reported by MITREHigh 7.5
In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2021Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "oCVE-2020-23234 · Other software · Lavalite · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2021Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.CVE-2020-23700 · Other software · Lavalite · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary CVE-2020-36397 · Other software · Lavalite · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web sCVE-2020-36396 · Other software · Lavalite · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scCVE-2020-36395 · Other software · Lavalite · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2021Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.CVE-2020-28124 · Other software · Lavalite · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2019XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.CVE-2019-18883 · Other software · Lavalite · reported by MITREMedium 6.1
XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 10, 2019LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.CVE-2019-17434 · Other software · Lavalite · reported by MITREMedium 5.4
LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2018LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.CVE-2018-16551 · Other software · Lavalite · reported by MITREMedium 5.4
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2018LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and CVE-2017-1000467 · Other software · Lavalite · reported by MITREMedium 5.4
LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.
- Product
- Lavalite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.