209 matches found
CVE-2022-42188
In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...
CVE-2022-42188
In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...
CVE-2022-42188
In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...
Lavalite 9.0.0 XSRF TOKEN cookie File path traversal Vulnerability
Title: Lavalite-9.0.0 XSRF-TOKEN cookie File path traversal Author: nu11secur1ty Vendor: https://lavalite.org/ Software: https://github.com/LavaLite/cms/releases/tag/v9.0.0 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/LavaLite Description: The XSRF-TOKEN cookie is...
LavaLite Stored Cross-site Scripting vulnerability
A stored cross site scripting XSS vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the New parameter...
GHSA-3CFG-RXH6-H2RH LavaLite Stored Cross-site Scripting vulnerability
A stored cross site scripting XSS vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the New parameter...
GHSA-GJF5-J475-P4G6 Stored XSS in LavaLite 5.8.0
A stored cross site scripting XSS vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter...
Stored XSS in LavaLite 5.8.0
A stored cross site scripting XSS vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter...
GHSA-VV33-27JM-CVXQ Stored XSS in LavaLite 5.8.0
A stored cross site scripting XSS vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter...
Stored XSS in LavaLite 5.8.0
A stored cross site scripting XSS vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter...
Cross Site Scripting (XSS) in LavaLite 5.8.0
Cross Site Scripting XSS in LavaLite 5.8.0 via the Address field...
GHSA-6R6H-VHG7-53X7 Cross Site Scripting (XSS) in LavaLite 5.8.0
Cross Site Scripting XSS in LavaLite 5.8.0 via the Address field...
GHSA-H7VH-6GMM-G7H9 Stored XSS in LavaLite 5.2.4
LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code...
Stored XSS in LavaLite 5.2.4
LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code...
GHSA-PXXP-283V-XPQ5 Stored XSS in LavaLite 5.5
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit...
Stored XSS in LavaLite 5.5
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit...
GHSA-592V-7FRM-H44Q Cross-site scripting in LavaLite-CMS
Cross Site Scripting XSS vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature...
Cross-site scripting in LavaLite-CMS
Cross Site Scripting XSS vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature...
Cross Site Scripting in LavaLite CMS
Cross Site Scripting XSS vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,"...
GHSA-V2F3-F8X4-M3W8 Cross Site Scripting in LavaLite CMS
Cross Site Scripting XSS vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,"...