{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"10.1.0"}],"component":"lavalite/cms","cve_ids":["CVE-2025-71177"],"ecosystem":"Packagist","epss":0.00223,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-w7rq-fgx4-4xcm","id":"tcs_01M5KF9W87K6W1EHSQEKGMQ5Q4","modified_at":"2026-02-03T03:08:31.476612Z","published_at":"2026-01-23T18:31:30Z","references":["https://osv.dev/vulnerability/GHSA-w7rq-fgx4-4xcm","https://nvd.nist.gov/vuln/detail/CVE-2025-71177","https://github.com/LavaLite/cms/issues/420","https://github.com/LavaLite/cms","https://lavalite.org","https://www.vulncheck.com/advisories/lavalite-cms-stored-xss-via-package-creation-and-search"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-w7rq-fgx4-4xcm","url":"https://osv.dev/vulnerability/GHSA-w7rq-fgx4-4xcm"},{"source":"nvd","source_id":"CVE-2025-71177","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71177"}],"summary":"LavaLite CMS affected by a stored cross-site scripting vulnerability"}