Stored Cross-Site Scripting Vulnerability in LavaLite CMS by LavaLite

CVE-2025-71177

What is CVE-2025-71177?

LavaLite CMS versions up to and including 10.1.0 are susceptible to a stored cross-site scripting vulnerability within the package creation and search functionality. This weakness allows authenticated users to insert malicious HTML or JavaScript content into the Name or Description fields of a package. Once stored, this content is rendered without appropriate output encoding in search results. Users viewing these results may find their browsers executing the injected scripts, potentially leading to session hijacking, unauthorized actions, and theft of sensitive credentials.

References