CVE-2025-71177

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-71177
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71177.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-71177
Aliases
Published
2026-01-23T16:40:56.486Z
Modified
2026-07-08T07:32:18.131072204Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search
Details

LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. When other users view search results that include the malicious package, the injected script executes in their browsers, potentially enabling session hijacking, credential theft, and unauthorized actions in the context of the victim.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71177.json"
}
References

Affected packages

Git / github.com/lavalite/cms

Affected ranges

Type
GIT
Repo
https://github.com/lavalite/cms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6b281860c480035b54d0a33eb686cf9977b0f634
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.1.0"
        }
    ],
    "cpe": "cpe:2.3:a:lavalite:lavalite:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

5.*
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.1
5.7.0
v10.*
v10.0.0
v10.0.2
v10.0.3
v10.0.4
v10.0.5
v10.0.6
v10.1.0
v5.*
v5.1.1
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v5.3.5
v5.3.6
v5.3.7
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71177.json"