Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
288 results · page 4 of 6
Feb 11, 2026Statmatic is a Laravel and Git powered content management system (CMS).CVE-2026-25759 · Other software · statamic · reported by GitHubHigh 8.7
Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Statamic is a, Laravel + Git powered CMS designed for building websites.CVE-2026-25633 · Other software · statamic · reported by GitHubMedium 4.3
Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. This has been fixed in 5.73.6 and 6.2.5.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.CVE-2026-22254 · Other software · wintercms · reported by GitHubNone
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter.CVE-2020-36950 · Other software · Laravel Holdings Inc. · reported by VulnCheckHigh 8.7
Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.
- Product
- Laravel Nova
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnova.laravel.comnova.laravel.com
Jan 21, 2026Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications.CVE-2026-23524 · Other software · laravel · reported by GitHubCritical 9.8
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). This issue has been fixed in version 1.7.0. As a workaround, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback, and/or set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely (if the environment uses only one Reverb node).
- Product
- reverb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Jan 16, 2026Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, alCVE-2025-14894 · Other software · bee interactive · reported by cret@cert.orgCritical 9.8
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
- Product
- Livewire Filemanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackingbydoing.wixsite.com
Jan 15, 2026Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges.CVE-2021-47756 · Other software · Laravel · reported by VulnCheckHigh 8.4
Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the symlinked valet command to execute arbitrary code with root permissions without additional authentication.
- Product
- Laravel Valet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaravel.comexploit-db.com
Jan 15, 2026Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries.CVE-2021-47763 · Websites & servers · Aimeos · reported by VulnCheckHigh 8.8
Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.
- Product
- Aimeos Laravel ecommerce platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21451 · Other software · bagisto · reported by GitHubMedium 5.2
Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited. This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution. Version 2.3.10 fixes the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21450 · Other software · bagisto · reported by GitHubHigh 7.3
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21449 · Other software · bagisto · reported by GitHubHigh 7.4
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21448 · Other software · bagisto · reported by GitHubHigh 8.9
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21447 · Other software · bagisto · reported by GitHubHigh 7.1
Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Bagisto is an open source laravel eCommerce platform.CVE-2026-21446 · Other software · bagisto · reported by GitHubHigh 8.8
Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Filament is a collection of full-stack components for accelerated Laravel development.CVE-2025-67507 · Other software · filamentphp · reported by GitHubHigh 8.1
Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.
- Product
- filament
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025LaraDashboard is an all-In-one solution to start a Laravel Application.CVE-2025-66509 · Other software · laradashboard · reported by GitHubHigh 8.9
LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process to automatically execute the ServiceProvider::boot() method, enabling arbitrary PHP code execution.
- Product
- laradashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.CVE-2025-65346 · Other software · Alexusmai · reported by MITRECritical 9.1
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.
- Product
- Laravel File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.CVE-2025-65345 · Other software · Alexusmai · reported by MITREMedium 6.5
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.
- Product
- Laravel File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS).CVE-2025-63307 · Other software · Alexusmai · reported by MITREHigh 8.1
alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.
- Product
- Laravel File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Statmatic is a Laravel and Git powered content management system (CMS).CVE-2025-64112 · Other software · statamic · reported by GitHubHigh 8
Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025Sharp is a content management framework built for Laravel as a package.CVE-2025-62798 · Other software · code16 · reported by GitHubMedium 5.4
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 .
- Product
- sharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload.CVE-2025-56399 · Other software · reported by MITREHigh 8.8
alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload. A file with a '.png` extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side validation, the file is still saved on the server. The attacker can then use the rename API to change the file extension to `.php`, and upon accessing it via a public URL, the server executes the embedded code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62418 · Other software · bagisto · reported by GitHubMedium 6.9
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62417 · Other software · bagisto · reported by GitHubHigh 7.1
Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This allows an attacker to supply a CSV field (e.g., product name) that contains a formula which may be evaluated by a victim’s spreadsheet application — potentially leading to data exfiltration and remote command execution (via older Excel exploits / OLE/cmd constructs or Excel macros). This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62416 · Other software · bagisto · reported by GitHubMedium 5.1
Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62415 · Other software · bagisto · reported by GitHubMedium 6.9
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62414 · Other software · bagisto · reported by GitHubMedium 6.9
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin’s browser or another user viewing the customer data, enabling session theft or admin-level actions. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2025-58163 · Other software · freescout-help-desk · reported by GitHubHigh 8.6
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier contain a deserialization of untrusted data vulnerability that allows authenticated attackers with knowledge of the application's APP_KEY to achieve remote code execution. The vulnerability is exploited via endpoint, e.g.: `/help/{mailbox_id}/auth/{customer_id}/{hash}/{timestamp}` where the `customer_id` and `timestamp` parameters are processed through the decrypt function in `app/Helper.php` without proper validation. The code decrypts using Laravel's built-in encryption functions, which subsequently deserialize the decrypted payload without sanitization, allowing attackers to craft malicious serialized PHP objects using classes to trigger arbitrary command execution. This is fixed in version 1.8.186.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.CVE-2025-55745 · Other software · unopim · reported by GitHubLow 2.5
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Versions 0.3.0 and prior are vulnerable to CSV injection, also known as formula injection, in the Quick Export feature. This vulnerability allows attackers to inject malicious content into exported CSV files. When the CSV file is opened in spreadsheet applications such as Microsoft Excel, the malicious input may be interpreted as a formula or command, potentially resulting in the execution of arbitrary code on the victim's device. Successful exploitation can lead to remote code execution, including the establishment of a reverse shell. Users are advised to upgrade to version 0.3.1 or later.
- Product
- unopim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.CVE-2025-55741 · Other software · unopim · reported by GitHubHigh 8.1
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist.
- Product
- unopim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.CVE-2025-55744 · Other software · unopim · reported by GitHubMedium 6.9
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). This vulnerability is fixed in 0.2.1.
- Product
- unopim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.megithub.com
Aug 21, 2025UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.CVE-2025-55743 · Other software · unopim · reported by GitHubHigh 7.3
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The vulnerability is fixed in 0.2.1.
- Product
- unopim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.megithub.com
Aug 21, 2025UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.CVE-2025-55742 · Other software · unopim · reported by GitHubHigh 8
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1.
- Product
- unopim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2025FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework).CVE-2025-54366 · Other software · freescout-help-desk · reported by GitHubHigh 8.6
FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework). In versions 1.8.185 and below, there is a critical deserialization vulnerability in the /conversation/ajax endpoint that allows authenticated users with knowledge of the APP_KEY to achieve remote code execution. The vulnerability occurs when the application processes the attachments_all and attachments POST parameters through the insecure Helper::decrypt() function, which performs unsafe deserialization of user-controlled data without proper validation. This flaw enables attackers to create arbitrary objects and manipulate their properties, leading to complete compromise of the web application. This is fixed in version 1.8.186.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap.CVE-2025-54082 · Other software · marshmallow-packages · reported by GitHubHigh 8.1
marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application. The vulnerability is due to missing authentication middleware (Nova and Nova.Auth) on the /nova-tiptap/api/file upload endpoint, the lack of validation on uploaded files (no MIME/type or extension restrictions), and the ability for an attacker to choose the disk parameter dynamically. This means an attacker can craft a custom form and send a POST request to /nova-tiptap/api/file, supplying a valid CSRF token, and upload executable or malicious files (e.g., .php, binaries) to public disks such as local, public, or s3. If a publicly accessible storage path is used (e.g. S3 with public access, or Laravel’s public disk), the attacker may gain the ability to execute or distribute arbitrary files — amounting to a potential Remote Code Execution (RCE) vector in some environments. This vulnerability was fixed in 5.7.0.
- Product
- nova-tiptap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Laravel Livewire Code Injection VulnerabilityCVE-2025-54068 · Other software · Laravel · reported by GitHubExploitedCritical 9.2
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
- Product
- Livewire
- On CISA’s list since
- Mar 20, 2026 (federal fix deadline Apr 3, 2026)
- What to do
- Attackers are using this now. Install Laravel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Jul 14, 2025LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app.CVE-2025-53833 · Other software · saleem-hadad · reported by GitHubCritical 10
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
- Product
- larecipe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/CVE-2025-34060 · Other software · Monero Project · reported by VulnCheckCritical 10
A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.
- Product
- Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Laravel Translation Manager is a package to manage Laravel translation files.CVE-2025-49130 · Other software · barryvdh · reported by GitHubMedium 6
Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Only authenticated users with access to the translation manager are impacted. The issue is fixed in version 0.6.8.
- Product
- laravel-translation-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Laravel Rest Api is an API generator.CVE-2025-48490 · Other software · Lomkit · reported by GitHubMedium 6.6
Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application. This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed. This issue has been patched in version 2.13.0.
- Product
- laravel-rest-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature.CVE-2025-26159 · Other software · reported by MITREMedium 6.1
Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgodbadtry.github.io
Apr 14, 2025DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php arCVE-2025-32931 · Other software · DevDojo · reported by MITRECritical 9.1
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command.
- Product
- Voyager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in tCVE-2024-13919 · Other software · Laravel Holdings Inc. · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aHigh 8
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
- Product
- Laravel Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters inCVE-2024-13918 · Other software · Laravel Holdings Inc. · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aHigh 8
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
- Product
- Laravel Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Laravel is a web application framework.CVE-2025-27515 · Other software · laravel · reported by GitHubMedium 6.9
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024Socialstream is a third-party package for Laravel Jetstream.CVE-2024-56329 · Other software · joelbutcher · reported by GitHubHigh 8.9
Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, with scaffolding that has support for Laravel Socialite. When linking a social account to an already authenticated user, the lack of a confirmation step introduces a security risk. This is exacerbated if ->stateless() is used in the Socialite configuration, bypassing state verification and making the exploit easier. Developers should ensure that users explicitly confirm account linking and avoid configurations that skip critical security checks. Socialstream v6.2 introduces a new custom route that requires a user to "Confirm" or "Deny" a request to link a social account. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- socialstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting theCVE-2024-21546 · Other software · reported by report@snyk.ioHigh 8.9
Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 13, 2024Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications.CVE-2024-55661 · Other software · laravel · reported by GitHubHigh 8.7
Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method in which the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable to component is `remember(callable $query, string $key = '')` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries`, and the vulnerability affects all Pulse card components that use this trait. Version 1.3.1 contains a patch.
- Product
- pulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.CVE-2024-54149 · Other software · wintercms · reported by GitHubHigh 8.4
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access via the permissions. As all objects passed through to Twig are references to the live objects, it is also possible to also manipulate model data if models are passed directly to Twig, including changing attributes or even removing records entirely. In most cases, this is unwanted behavior and potentially dangerous. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any of the following permissions: `cms.manage_layouts`; `cms.manage_pages`; or `cms.manage_partials`. The Winter CMS maintainers strongly recommend that these permissions only be reserved to trusted administrators and developers in general. The maintainers of Winter CMS have significantly increased the scope of the sandbox, effectively making all models and da
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Statmatic is a Laravel and Git powered content management system (CMS).CVE-2024-52600 · Other software · statamic · reported by GitHubMedium 5.3
Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.