Lightcms Project · weakness class

Cross-site Scripting

4 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.CVE-2021-3355Lightcms Project · 7.2% likely
CWE-79
A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file.CVE-2022-33009Lightcms Project · 0.5% likely
CWE-79
LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.CVE-2024-22559Lightcms Project · CVSS 5.4 · 0.3% likely
CWE-79
A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to execute arbitrary Javascript in the context of the user's b…CVE-2026-29934Lightcms Project · CVSS 6.1 · 0.2% likely
CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.