Vulnerabilidades en litespeedtech
17 resultadosCVE-2023-4372MEDIUMLiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 19.5%CVE-2025-54939MEDIUMLiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.EPSS 0.8%CVE-2025-24947MEDIUMA hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attaEPSS 0.7%CVE-2026-18978HIGHLiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.4%CVE-2026-115482HIGHIn lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not liEPSS 0.4%CVE-2026-76579MEDIUMLiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' ParameterEPSS 0.4%CVE-2025-12450MEDIUMLiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-3375HIGHLiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API EndpointsEPSS 0.4%CVE-2026-93903CRITICALLiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e doubleEPSS 0.4%CVE-2026-116763MEDIUMLiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)EPSS 0.3%CVE-2026-109215MEDIUMLiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-SerializationEPSS 0.3%CVE-2026-3129MEDIUMLiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag AttributesEPSS 0.3%CVE-2026-119559HIGHOpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host MismatchEPSS 0.3%CVE-2024-9169MEDIUMlitespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-93389HIGHLiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST CachingEPSS 0.2%CVE-2024-3246MEDIUMLiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-104474MEDIUMOpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-UpdateEPSS 0.1%