Disclosure summary
LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. When other users view search results that include the malicious package, the injected script executes in their browsers, potentially enabling session hijacking, credential theft, and unauthorized actions in the context of the victim.
Source-reported weakness categories
CWE-79
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-71177
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| lavalite | lavalite | * {"versionEndIncluding":"10.1.0"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Exploit, Issue Tracking
- lavalite.org — Product
- www.vulncheck.com — Third Party Advisory
PUBLISHED 2026-01-23T12:16:08-05:00
MODIFIED 2026-10-08T12:16:52-04:00
INGESTED 2026-10-10T20:50:35-04:00