CVE-2026-108951 debrief: LavaLite CMS 10.1.2 authorization bypass via User Update API allows low-privileged users to modify other users' accounts, including administrators. This vulnerability enables attackers to send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile. Defenders must assess exposure and implement compensating controls to re [truncated]
CVE-2025-71177 is a stored cross-site scripting (XSS) vulnerability affecting LavaLite CMS versions up to and including 10.1.0. The vulnerability exists in the package creation and search functionality, allowing authenticated users to inject malicious HTML or JavaScript in package Name or Description fields. This injected script is stored and later rendered without proper output encoding in package search [truncated]
