Composer lavalite/cms has 14 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-42188 | Lavalite vulnerable to Arbitrary File Read via Directory Traversal | high | 7.5 | =9.0.0 | – |
| CVE-2023-27238 | LavaLite vulnerable to web cache poisoning | critical | 9.8 | <=9.0.0 | – |
| CVE-2017-1000467 | Stored XSS in LavaLite 5.2.4 | medium | 5.4 | <=5.2.4 | – |
| CVE-2018-16551 | Stored XSS in LavaLite 5.5 | medium | 5.4 | all versions | – |
| CVE-2020-23234 | Cross Site Scripting in LavaLite CMS | medium | 4.8 | <=5.8.0 | – |
| CVE-2023-27237 | LavaLite CMS vulnerable to host header injection attack | medium | 6.1 | <=9.0.0 | – |
| CVE-2020-23700 | Cross-site scripting in LavaLite-CMS | medium | 4.8 | <=5.8.0 | – |
| CVE-2020-36397 | LavaLite Stored Cross-site Scripting vulnerability | medium | 5.4 | <=5.8.0 | – |
| CVE-2020-28124 | Cross Site Scripting (XSS) in LavaLite 5.8.0 | medium | 5.4 | <7.0.1 | 7.0.1 |
| CVE-2020-36395 | Stored XSS in LavaLite 5.8.0 | medium | 5.4 | <5.8.0 | 5.8.0 |
| CVE-2024-31828 | Lavalite CMS Cross Site Scripting vulnerability | medium | 6.1 | =10.1.0 | – |
| CVE-2020-36396 | Stored XSS in LavaLite 5.8.0 | medium | 5.4 | <=5.8.0 | – |
| CVE-2023-30124 | LavaLite vulnerable to Cross Site Scripting | medium | 5.4 | <=9.0.0 | – |
| CVE-2025-71177 | LavaLite CMS affected by a stored cross-site scripting vulnerability | medium | 0.0 | <=10.1.0 | – |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked