Laravel

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value.

A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.

A vulnerability was found in laravel 5.1 and classified as problematic.

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI.

A vulnerability, which was classified as critical, was found in Laravel 5.1.

Laravel is a web application framework.

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0.

An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2.

Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.