{"id":"GHSA-6r6h-vhg7-53x7","aliases":["CVE-2020-28124"],"title":"Cross Site Scripting (XSS) in LavaLite 5.8.0","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.","severity":"medium","score":5.4,"published":"2022-05-24T17:47:31.000Z","modified":"2024-02-16T08:22:55.945Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"lavalite/cms","sources":[{"name":"OSV · GHSA-6r6h-vhg7-53x7","url":"https://osv.dev/vulnerability/GHSA-6r6h-vhg7-53x7"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"7.0.1"}],"type":"ECOSYSTEM"}],"versions":["5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6","5.5.7","5.5.8","5.5.9","5.6.1","5.6.2","5.7.0","5.7.1","5.7.2","5.7.3","5.7.4","v5.0.0","v5.1.0","v5.1.1","v5.2.0","v5.2.1","v5.2.2","v5.2.3","v5.2.4","v5.3.0","v5.3.1","v5.3.2","v5.3.3","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.4.0","v5.4.1","v5.4.2","v5.4.3","v5.4.4","v5.4.5","v5.8.0"],"fixed":["7.0.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-28124","https://github.com/418sec/cms/pull/1","https://github.com/LavaLite/cms/pull/339","https://github.com/LavaLite/cms/pull/339/commits/fe5e71c34d37a601e6208f671e34f04b56e3a02d"],"sources":[{"name":"OSV","id":"GHSA-6r6h-vhg7-53x7","modified":"2024-02-16T08:22:55.945329Z","url":"https://osv.dev/vulnerability/GHSA-6r6h-vhg7-53x7"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:50:31.598Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}