Get real-time updates on Telegram
CVE-2025-71177: lavalite through 10.1.0 (inclusive); +1 more affected products
CVE-2025-71177. CVSS 3.1 base score 5.4 (MEDIUM, NVD). EPSS 0.00226 (percentile 0.12182), scored 06-Oct-2026.
Affected technology
lavalite · through 10.1.0 (inclusive)
lavalite
LavaLite CMS · 0 through 10.1.0
LavaLite
Description’s affected range: versions up to and including 10.1.0
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction
What an attacker can do
Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and integrity impact as low; availability impact as none.
- CWE
- CWE-79
- CCR priority
- 21.7 /100 (P4)
- CVSS 3.1
- 5.4 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · NVD
- EPSS
- 0.00226 · percentile 0.12258 · 2026-10-11
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-11 23:42:05.235979+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-08 17:32:11.049884+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-71177.html