Lavalite CVE-2023-27237

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2023-05-12 cve@mitre.org

6.1

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

May 12, 2023 - 11:15 nvd

MEDIUM 6.1

DescriptionNVD

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.

AnalysisAI

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack. Affected products include: Lavalite.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

More in Lavalite

View all

CVE-2025-70866 HIGH This Week POC

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User rol

CVE-2022-42188 HIGH This Week POC

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary file

CVE-2024-31828 MEDIUM This Month POC

Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensit

CVE-2019-18883 MEDIUM This Month POC

XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field. Rated medium severity (CVSS 6.1), this v

CVE-2023-27238 CRITICAL Act Now

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. Rated critical severity (CVSS 9.8), this vu

CVE-2023-30124 MEDIUM This Month POC

LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is rem

CVE-2019-17434 MEDIUM This Month POC

LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen. Rated medium se

CVE-2018-16551 MEDIUM This Month POC

LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit. Rated medium severity (CVSS 5.4

CVE-2025-71177 MEDIUM This Month POC

LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package crea

CVE-2023-36984 HIGH This Week

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. Rated high severity (CVSS 7.5), this vulnerability is rem

CVE-2023-36983 HIGH This Week

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. Rated high severity (CVSS 7.5), this vulnerability is rem

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2013-7389 MEDIUM POC

CVE-2021-25299 MEDIUM POC

CVE-2014-2120 MEDIUM

CVE-2023-40000 HIGH POC

CVE-2016-8581 MEDIUM POC

CVE-2013-5223 MEDIUM POC

CVE-2025-52367 MEDIUM POC

CVE-2015-0072 MEDIUM POC

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

CVE-2013-1710 CRITICAL POC

CVE-2013-7389 MEDIUM POC

CVE-2021-25299 MEDIUM POC

CVE-2014-2120 MEDIUM

CVE-2023-40000 HIGH POC

CVE-2024-52875 HIGH POC

CVE-2016-8581 MEDIUM POC

Share

CVE-2023-27237 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy