TI-2024-34976 CVE-2024-52301 · GHSA-gv7v-rgg6-548h
Laravel allows environment manipulation via query string
Priority HIGH 73
Laravel is a web application framework.
Laravel
Records35All Threatist records
Exploited (KEV)3In CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high18CVSS 7.0–8.9
Exploited now
Laravel records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
9 records in Framework · all components
TI-2024-12938 CVE-2024-13919 · GHSA-83wp-f5c3-hqqr
Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page
Priority HIGH 70
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
TI-2024-12937 CVE-2024-13918 · GHSA-546h-56qp-8jmw
Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
Priority HIGH 70
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
TI-2022-19208 CVE-2022-40482 · GHSA-5qxg-5vwh-7j5j
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be…
Priority MEDIUM 63
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing.
TI-2021-19485 CVE-2021-43617
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP…
Priority MEDIUM 61
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as applica…
TI-2020-13600 CVE-2020-19316 · GHSA-w2pm-r78h-4m7v
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
Priority MEDIUM 43
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
TI-2018-04655 CVE-2018-6330 · GHSA-wwgw-h9gv-285x
Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters.
Priority MEDIUM 41
Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters.
TI-2025-20347 CVE-2025-27515 · GHSA-78fx-h6xr-vch4
Laravel has a File Validation Bypass
Priority LOW 38
Laravel is a web application framework.
TI-2021-19614 CVE-2021-43808 · GHSA-66hf-2p6w-jqfw
Blade `@parent` Exploitation Leading To Possible XSS in Laravel
Priority LOW 29
Laravel is a web application framework.