CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-13919 – Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page
https://notcve.org/view.php?id=CVE-2024-13919
10 Mar 2025 — The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page. • https://github.com/laravel/framework/pull/53869 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-13918 – Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
https://notcve.org/view.php?id=CVE-2024-13918
10 Mar 2025 — The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page. • https://github.com/laravel/framework/pull/53869 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2025-27515 – Laravel has a File Validation Bypass
https://notcve.org/view.php?id=CVE-2025-27515
05 Mar 2025 — Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1. • https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5 • CWE-155: Improper Neutralization of Wildcards or Matching Symbols •
CVSS: 8.7EPSS: 26%CPEs: 6EXPL: 3CVE-2024-52301 – Laravel allows environment manipulation via query string
https://notcve.org/view.php?id=CVE-2024-52301
12 Nov 2024 — Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs. • https://github.com/Nyamort/CVE-2024-52301 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.5EPSS: 6%CPEs: 1EXPL: 2CVE-2024-29291 – Laravel Framework 11 - Credential Leakage
https://notcve.org/view.php?id=CVE-2024-29291
16 Apr 2024 — An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged. Un problema en Laravel Framework 8 a 11 podría permitir que un atacante remoto descubra las credenciales de la base de datos en Storage/logs/laravel... • https://packetstorm.news/files/id/178210 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 2CVE-2022-40482
https://notcve.org/view.php?id=CVE-2022-40482
25 Apr 2023 — The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist. • https://ephort.dk/blog/laravel-timing-attack-vulnerability • CWE-203: Observable Discrepancy •
CVSS: 8.8EPSS: 5%CPEs: 2EXPL: 1CVE-2020-19316
https://notcve.org/view.php?id=CVE-2020-19316
20 Dec 2021 — OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. Una vulnerabilidad de inyección de comandos en el enlace de la función Filesystem.php en Laravel Framework versiones anteriores a 5.8.17 • http://www.netbytesec.com/advisories/OSCommandInjectionInLaravelFramework • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2021-43808 – Blade `@parent` Exploitation Leading To Possible XSS in Laravel
https://notcve.org/view.php?id=CVE-2021-43808
07 Dec 2021 — Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. • https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 47%CPEs: 1EXPL: 4CVE-2021-43617 – PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2021-43617
14 Nov 2021 — Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload. Laravel Framework hasta la versión 8.70.2 no bloquea suficientemente la subida de contenido PHP ejec... • https://www.exploit-db.com/exploits/50525 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-6330
https://notcve.org/view.php?id=CVE-2018-6330
28 Mar 2019 — Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters. Laravel, en su versión 5.4.15, es vulnerable a inyección SQL basada en errores en save.php mediante los parámetros dhx_user y dhx_version. • http://www.itblog.gbonanno.de/cve-2018-6330-laravel-sql-injection • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •