Facade

Records3All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Facade records in CISA KEV

TI-2021-02221 Laravel Ignition File Upload Vulnerability CRITICAL 100KEV 2023-09-18

Components

Products in the NVD configurations · select one to filter the records

Ignition 3 records CRITICAL

Records

3 records in Ignition · all components

TI-2021-02221 CVE-2021-3129 · GHSA-4qwp-7c67-jmcc

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated…

CRITICAL 100KEV

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99943 Published 2021-01-12 Fixed in 2.5.2, 2.4.2 +2 CWE-94

TI-2021-19748 CVE-2021-43996 · GHSA-vhrp-8qx4-vr6c

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix…

MEDIUM 46

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01725 Published 2021-11-17 Fixed in 1.16.15, 2.0.6 CWE-284

TI-2020-10887 CVE-2020-13909 · GHSA-m5v7-pr32-mjx2

The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie…

MEDIUM 45

The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01516 Published 2020-06-07 Fixed in 2.0.5, 1.16.15

Open these records in search →

Critical	3
High	0
Medium	0
Low	0
No CVSS	0