Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
288 results · page 5 of 6
Nov 13, 2024FileManager provides a Backpack admin interface for files and folder.CVE-2024-52306 · Other software · Laravel-Backpack · reported by GitHubHigh 7.6
FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.
- Product
- FileManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.CVE-2024-52305 · Other software · unopim · reported by GitHubMedium 6.5
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. This vulnerability is fixed in 0.1.5.
- Product
- unopim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Laravel is a web application framework.CVE-2024-52301 · Other software · laravel · reported by GitHubHigh 8.7
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 11, 2024Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards.CVE-2024-51992 · Other software · orchidsoftware · reported by GitHubMedium 4.1
Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability is a method exposure issue (CWE-749: Exposed Dangerous Method or Function) in the Orchid Platform’s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within the `Screen` class, leading to potential brute force of database tables, validation checks against user credentials, and disclosure of the server’s real IP address. The issue has been patched in the latest release, version 14.43.0, released on November 6, 2024. Users should upgrade to version 14.43.0 or later to address this vulnerability. If upgrading to version 14.43.0 is not immediately possible, users can mitigate the vulnerability by implementing middleware to intercept and validate requests to asynchronous modal endpoints, allowing only approved methods and parameters.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024File Upload vulnerability in Laravel CMS v.1.4.7 and before allows a remote attacker to execute arbitrary code via the shell.php a component.CVE-2024-51152 · Other software · alexstack · reported by MITREHigh 7.2
File Upload vulnerability in Laravel CMS v.1.4.7 and before allows a remote attacker to execute arbitrary code via the shell.php a component.
- Product
- laravel_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024Filament is a collection of full-stack components for accelerated Laravel development.CVE-2024-51758 · Other software · filamentphp · reported by GitHubLow 2.3
Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the `default_filesystem_disk` config option. This allows the user to easily swap their storage driver to something production-ready like `s3` when deploying their app, without having to touch multiple configuration options and potentially forgetting about some. The default disk is set to `public` when you first install Filament, since this allows users to quickly get started developing with a functional disk that allows features such as file upload previews locally without the need to set up an S3 disk with temporary URL support. However, some features of Filament such as exports also rely on storage, and the files that are stored contain data that should often not be public. This is not an issue for the many deployed applications, since many use a secure default disk such as S3 in production. However, [CWE-1188](https://cwe.mitre.org/data/definitions/1188.html) suggests that having the `public` disk as the default disk in Filament is a security vulnerability itself. As such, we have implemented a measure to protect users whereby if the `public
- Product
- filament
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilamentphp.comgithub.com
Oct 31, 2024Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications.CVE-2024-50347 · Other software · laravel · reported by GitHubMedium 6.3
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker. This vulnerability is fixed in 1.4.0.
- Product
- reverb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP.CVE-2024-47823 · Other software · livewire · reported by GitHubHigh 7.7
Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., `image/png`) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack: 1. Filename is composed of the original file name using `$file->getClientOriginalName()`. 2. Files stored directly on your server in a public storage disk. 3. Webserver is configured to execute “.php” files. This issue has been addressed in release versions `2.12.7` and `3.5.2`. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- livewire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Filament is a collection of full-stack components for Laravel development.CVE-2024-47186 · Other software · filamentphp · reported by GitHubMedium 6.1
Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.
- Product
- filament
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2024Wire UI is a library of components and resources to empower Laravel and Livewire application development.CVE-2024-45803 · Other software · wireui · reported by GitHubMedium 5.1
Wire UI is a library of components and resources to empower Laravel and Livewire application development. A potential Cross-Site Scripting (XSS) vulnerability has been identified in the `/wireui/button` endpoint, specifically through the `label` query parameter. Malicious actors could exploit this vulnerability by injecting JavaScript into the `label` parameter, leading to the execution of arbitrary code in the victim's browser. The `/wireui/button` endpoint dynamically renders button labels based on user-provided input via the `label` query parameter. Due to insufficient sanitization or escaping of this input, an attacker can inject malicious JavaScript. By crafting such a request, an attacker can inject arbitrary code that will be executed by the browser when the endpoint is accessed. If exploited, this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the affected website. This could lead to: **Session Hijacking**: Stealing session cookies, tokens, or other sensitive information. **User Impersonation**: Performing unauthorized actions on behalf of authenticated users. **Phishing**: Redirecting users to malicious websites. **Content Mani
- Product
- wireui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87.CVE-2024-7067 · Websites & servers · kirilkirkov · reported by VulDBMedium 5.3
A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87. It has been rated as critical. Affected by this issue is the function getCartProductsIds of the file app/Cart.php. The manipulation of the argument laraCart leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is a02111a674ab49f65018b31da3011b1e396f59b1. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-272348.
- Product
- Ecommerce-Laravel-Bootstrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2024Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.CVE-2024-40075 · Other software · reported by MITREMedium 4.3
Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2024October is a self-hosted CMS platform based on the Laravel PHP Framework.CVE-2024-25637 · Other software · octobercms · reported by GitHubLow 3.1
October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. This issue has been patched in version 3.5.15.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024October is a self-hosted CMS platform based on the Laravel PHP Framework.CVE-2024-24764 · Other software · octobercms · reported by GitHubLow 3.5
October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0.CVE-2024-6056 · Other software · nasirkhan · reported by VulDBMedium 6.3
A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /forgot-password of the component Password Reset Handler. The manipulation of the argument Email leads to observable response discrepancy. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268784. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Laravel Starter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpowerful-bulb-c36.notion.sitevuldb.com
May 30, 2024Statamic is a, Laravel + Git powered CMS designed for building websites.CVE-2024-36119 · Other software · statamic · reported by GitHubLow 1.8
Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have their password confirmation stored in plain text in their user file. This only affects sites matching **all** of the following conditions: 1. Running Statamic versions between 5.3.0 and 5.6.1. (This version range represents only one calendar week), 2. Using the `user:register_form` tag. 3. Using file-based user accounts. (Does not affect users stored in a database.), 4. Has users that have registered during that time period. (Existing users are not affected.). Additionally passwords are only visible to users that have access to read user yaml files, typically developers of the application itself. This issue has been patched in version 5.6.2, however any users registered during that time period and using the affected version range will still have the the `password_confirmation` value in their yaml files. We recommend that affected users have their password reset. System administrators are advised to upgrade their deployments. There are no known workarounds for this vulnerability. Anyone who commits their files to a public git repo
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log.CVE-2024-29291 · Other software · laravel · reported by MITRE
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 12, 2024wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS.CVE-2024-32003 · Other software · wintercms · reported by GitHubHigh 8.8
wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS. The Dusk plugin provides some special routes as part of its testing framework to allow a browser environment (such as headless Chrome) to act as a user in the Backend or User plugin without having to go through authentication. This route is `[[URL]]/_dusk/login/[[USER ID]]/[[MANAGER]]` - where `[[URL]]` is the base URL of the site, `[[USER ID]]` is the ID of the user account and `[[MANAGER]]` is the authentication manager (either `backend` for Backend, or `user` for the User plugin). If a configuration of a site using the Dusk plugin is set up in such a way that the Dusk plugin is available publicly and the test cases in Dusk are run with live data, this route may potentially be used to gain access to any user account in either the Backend or User plugin without authentication. As indicated in the `README`, this plugin should only be used in development and should *NOT* be used in a production instance. It is specifically recommended that the plugin be installed as a development dependency only in Composer. In order to remediate this issue, the special routes used above will now
- Product
- wn-dusk-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property.CVE-2024-21504 · Other software · laravel · reported by report@snyk.ioMedium 6.1
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.
- Product
- livewire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024Statamic is a Laravel and Git powered CMS.CVE-2024-24570 · Other software · statamic · reported by GitHubHigh 8.2
Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 1, 2024Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function.CVE-2024-22859 · Other software · Laravel · reported by MITREHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the vendor disputes this because the 5d88731 commit fixes a usability problem (HTTP 419 status codes for legitimate client activity), not a security problem.
- Product
- Livewire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Statamic CMS is a Laravel and Git powered content management system (CMS).CVE-2023-48701 · Other software · statamic · reported by GitHubHigh 7.5
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Statamic is a flat-first, Laravel + Git powered CMS designed for building websites.CVE-2023-48217 · Other software · statamic · reported by GitHubHigh 8.8
Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Statmic is a core Laravel content management system Composer package.CVE-2023-47129 · Other software · statamic · reported by GitHubHigh 8.3
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards.CVE-2023-36825 · Other software · orchidsoftware · reported by GitHubCritical 9.6
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.CVE-2023-37269 · Other software · wintercms · reported by GitHubLow 2
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting (XSS) attack. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly. These two factors significantly limit the potential harm of this vulnerability. This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files. As a workaround, one may a
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 5, 2023Statamic is a flat-first, Laravel and Git powered content management system.CVE-2023-36828 · Other software · statamic · reported by GitHubMedium 5.5
Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.CVE-2023-29931 · Other software · Laravels Project · reported by MITRECritical 9.8
laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.
- Product
- Laravels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 mCVE-2022-40482 · Other software · Laravel · reported by MITREMedium 5.3
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.CVE-2021-28254 · Other software · Laravel · reported by MITRECritical 9.8
A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.
- Product
- Laravel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD records1mple-top.github.ios1mple-top.github.io
Feb 27, 2023An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2023-24249 · Other software · Laravel-admin · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Laravel-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability classified as critical was found in laravel-jqgrid.CVE-2021-4262 · Other software · unspecified · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.
- Product
- laravel-jqgrid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022Winter is a free, open-source content management system based on the Laravel PHP framework.CVE-2022-39357 · Other software · wintercms · reported by GitHubHigh 8.1
Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework.CVE-2022-35944 · Other software · octobercms · reported by GitHubMedium 6.2
October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F..CVE-2022-40734 · Other software · Unisharp · reported by MITREMedium 6.5
UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022. This is related to league/flysystem before 2.0.0.
- Product
- Laravel Filemanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2022Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedoneCVE-2022-38089 · Other software · Kajitori Co.,Ltd · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.
- Product
- Exment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2022Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedCVE-2022-38080 · Other software · Kajitori Co.,Ltd · reported by vultures@jpcert.or.jpMedium 5.4
Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.
- Product
- Exment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2022SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4CVE-2022-37333 · Other software · Kajitori Co.,Ltd · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows remote authenticated attackers to execute arbitrary SQL commands.
- Product
- Exment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022A vulnerability, which was classified as critical, was found in Laravel 5.1.CVE-2022-2886 · Other software · unspecified · reported by VulDBMedium 5
A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-206688.
- Product
- Laravel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022A vulnerability was found in laravel 5.1 and classified as problematic.CVE-2022-2870 · Other software · unspecified · reported by VulDBMedium 4.1
A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206501 was assigned to this vulnerability.
- Product
- laravel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework.CVE-2022-24800 · Other software · octobercms · reported by GitHubHigh 8.1
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022Statamic is a Laravel and Git powered CMS.CVE-2022-24784 · Other software · statamic · reported by GitHubLow 3.7
Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire hash. The hash is not present in the response, however the presence or absence of a result confirms if the character is in the right position. The API has throttling enabled by default, making this a time intensive task. Both the REST API and the users endpoint need to be enabled, as they are disabled by default. The issue has been fixed in versions 3.2.39 and above, and 3.3.2 and above.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route.CVE-2021-45040 · Other software · Spatie · reported by MITRECritical 9.8
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route.
- Product
- Laravel Media Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecthreat.comspatie.be
Feb 24, 2022Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.CVE-2022-25838 · Other software · Laravel · reported by MITREHigh 8.1
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
- Product
- Fortify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2022Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework.CVE-2022-23655 · Other software · octobercms · reported by GitHubMedium 4.8
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server signature validation.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2022Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework.CVE-2022-21705 · Other software · octobercms · reported by GitHubHigh 7.2
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework.CVE-2021-32650 · Other software · octobercms · reported by GitHubHigh 8.8
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework.CVE-2021-32649 · Other software · octobercms · reported by GitHubHigh 8.8
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2021OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.CVE-2020-19316 · Other software · Laravel · reported by MITREHigh 8.8
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetbytesec.comgithub.com
Dec 17, 2021This affects versions of the package unisharp/laravel-filemanager before 2.6.2.CVE-2021-23814 · Other software · Unisharp · reported by report@snyk.ioMedium 6.7
This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: 1. Install a package with a web Laravel application. 2. Navigate to the Upload window 3. Upload an image file, then capture the request 4. Edit the request contents with a malicious file (webshell) 5. Enter the path of file uploaded on URL - Remote Code Execution **Note:** Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).
- Product
- Laravel-filemanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.