Packagist/lavalite/cms CVE-2025-71177: medium 5.4, EPSS 0.22%
LavaLite CMS affected by a stored cross-site scripting vulnerability
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 10.1.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-w7rq-fgx4-4xcm
- nvd: CVE-2025-71177
- https://github.com/LavaLite/cms/issues/420
- https://github.com/LavaLite/cms
- https://lavalite.org
- https://www.vulncheck.com/advisories/lavalite-cms-stored-xss-via-package-creation-and-search
CVE-2025-71177 · published · modified · JSON