CMS
by Havalite
CVEs (13)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-27238 | Cri | 0.64 | 9.8 | 0.01 | May 12, 2023 | LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. | ||
| CVE-2025-70866 | Hig | 0.57 | 8.8 | 0.00 | Feb 13, 2026 | LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share… | ||
| CVE-2023-36984 | Hig | 0.49 | 7.5 | 0.01 | Aug 1, 2023 | LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. | ||
| CVE-2023-36983 | Hig | 0.49 | 7.5 | 0.01 | Aug 1, 2023 | LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. | ||
| CVE-2024-31828 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2024 | Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL. | ||
| CVE-2023-27237 | Med | 0.40 | 6.1 | 0.01 | May 12, 2023 | LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack. | ||
| CVE-2019-18883 | Med | 0.40 | 6.1 | 0.01 | Nov 13, 2019 | XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field. | ||
| CVE-2013-0161 | Med | 0.38 | 5.4 | 0.01 | Jan 29, 2020 | Havalite CMS 1.1.7 has a stored XSS vulnerability | ||
| CVE-2025-71177 | Med | 0.35 | 5.4 | 0.00 | Jan 23, 2026 | LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later… | ||
| CVE-2012-5919 | 0.03 | — | 0.02 | Nov 19, 2012 | Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php, (4) the Edit… | |||
| CVE-2012-5894 | 0.03 | — | 0.01 | Nov 17, 2012 | SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter. | |||
| CVE-2012-5893 | 0.00 | — | 0.03 | Nov 17, 2012 | Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then accessing it via a direct request to the file in tmp/files/. | |||
| CVE-2012-5892 | 0.00 | — | 0.01 | Nov 17, 2012 | Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3. |
- risk 0.64cvss 9.8epss 0.01
LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.
- risk 0.57cvss 8.8epss 0.00
LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share…
- risk 0.49cvss 7.5epss 0.01
LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
- risk 0.49cvss 7.5epss 0.01
LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.
- risk 0.40cvss 6.1epss 0.01
LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.
- risk 0.40cvss 6.1epss 0.01
XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.
- risk 0.38cvss 5.4epss 0.01
Havalite CMS 1.1.7 has a stored XSS vulnerability
- risk 0.35cvss 5.4epss 0.00
LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later…
- CVE-2012-5919Nov 19, 2012risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php, (4) the Edit…
- CVE-2012-5894Nov 17, 2012risk 0.03cvss —epss 0.01
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter.
- CVE-2012-5893Nov 17, 2012risk 0.00cvss —epss 0.03
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then accessing it via a direct request to the file in tmp/files/.
- CVE-2012-5892Nov 17, 2012risk 0.00cvss —epss 0.01
Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3.