LavaLite CMS vulnerable to host header injection attack

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-27237 · ADVISORY
• LavaLite/cms · PACKAGE
• M19O/Security-Advisories · WEB
• i.ibb.co/34DSW7B/1.png · WEB
• i.ibb.co/kSkqPhQ/3.png · WEB
• i.ibb.co/mJq9CH8/2.png · WEB
• lavalite.com · WEB

Más vulnerabilidades de lavalite/cms

• CVE-2025-71177MEDIO 5.4LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search func…
• CVE-2024-31828MEDIO 6.1Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via …
• CVE-2023-30124MEDIO 5.4LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).
• CVE-2023-27238CRÍTICO 9.8LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.
• CVE-2022-42188ALTO 7.5In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.