Lavalite CVE-2018-16551

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2018-09-05 cve@mitre.org

5.4

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Sep 05, 2018 - 22:29 nvd

MEDIUM 5.4

DescriptionNVD

LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.

AnalysisAI

LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit. Affected products include: Lavalite.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

More in Lavalite

View all

CVE-2025-70866 HIGH This Week POC

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User rol

CVE-2022-42188 HIGH This Week POC

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary file

CVE-2024-31828 MEDIUM This Month POC

Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensit

CVE-2019-18883 MEDIUM This Month POC

XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field. Rated medium severity (CVSS 6.1), this v

CVE-2023-27238 CRITICAL Act Now

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. Rated critical severity (CVSS 9.8), this vu

CVE-2023-30124 MEDIUM This Month POC

LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is rem

CVE-2019-17434 MEDIUM This Month POC

LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen. Rated medium se

CVE-2025-71177 MEDIUM This Month POC

LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package crea

CVE-2023-36984 HIGH This Week

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. Rated high severity (CVSS 7.5), this vulnerability is rem

CVE-2023-36983 HIGH This Week

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. Rated high severity (CVSS 7.5), this vulnerability is rem

CVE-2023-27237 MEDIUM This Month

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack. Rated medium severity (CVSS 6.1)

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2013-7389 MEDIUM POC

CVE-2021-25299 MEDIUM POC

CVE-2014-2120 MEDIUM

CVE-2023-40000 HIGH POC

CVE-2016-8581 MEDIUM POC

CVE-2013-5223 MEDIUM POC

CVE-2025-52367 MEDIUM POC

CVE-2015-0072 MEDIUM POC

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

CVE-2013-1710 CRITICAL POC

CVE-2013-7389 MEDIUM POC

CVE-2021-25299 MEDIUM POC

CVE-2014-2120 MEDIUM

CVE-2023-40000 HIGH POC

CVE-2024-52875 HIGH POC

CVE-2016-8581 MEDIUM POC

Share

CVE-2018-16551 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy