Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L P L L N 5.1 .0023 12.4 —
AFFECTED Product Versions Fixed LavaLite CMS unspecified —
TIMELINE Jan 22 Reserved by VulnCheck Jan 23 Published (CNA: VulnCheck) Oct 8 EXPLOIT PUBLISHED — CVE-2025-71177 (LavaLite CMS). Public exploit reference added.
LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. When other users view search results that include the malicious package, the injected script executes in their browsers, potentially enabling session hijacking, credential theft, and unauthorized actions in the context of the victim.
| Date | Event | Detail |
|---|---|---|
| January 22, 2026 | Reserved | Reserved by VulnCheck |
| January 23, 2026 | Published | Published (CNA: VulnCheck) |
| October 8, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2025-71177 (LavaLite CMS). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| LavaLite | LavaLite CMS | — | — | — |
Authoritative record: CVE-2025-71177 at cve.org
Vendors: lavalite
Weaknesses: CWE-79
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-71177 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
