Priority HIGH 76
A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0132 · Published 2023-04-18 · No fix listed CWE-502
Priority HIGH 71
A vulnerability, which was classified as critical, was found in Laravel 5.1.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00732 · Published 2022-08-19 · No fix listed CWE-502
Priority HIGH 75
A vulnerability was found in laravel 5.1 and classified as problematic.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00851 · Published 2022-08-17 · No fix listed CWE-502
Priority LOW 35
Laravel is a web application framework.
CVSS 3.1HIGH 7.2· Network · No auth · No interaction · EPSS 0.01625 · Published 2021-01-19 · Fixed in 6.20.11, 7.30.2 +3 CWE-74
Priority LOW 35
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01203 · Published 2020-09-04 · Fixed in 6.18.34, 7.23.2 CWE-20
Priority LOW 35
An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0109 · Published 2020-09-04 · Fixed in 6.18.35, 7.24.0 CWE-863
Priority CRITICAL 94KEV
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.7657 · Published 2018-08-09 · Fixed in 5.6.30 CWE-502
Priority HIGH 75
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.86916 · Published 2017-11-20 · No fix listed CWE-200
Priority LOW 29
Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01193 · Published 2017-09-27 · Fixed in 5.5.10 CWE-200
Priority LOW 29
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00959 · Published 2017-05-29 · Fixed in 5.4.22 CWE-20
THREATIST.IORead the docs