Vulnerabilities

Laravel is a web application framework.

Laravel is a web application framework.

Laravel is a web application framework.

Laravel is a web application framework.

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUse…

Laravel Passport provides OAuth2 server support to Laravel.

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications.

Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges.

Livewire is a full-stack framework for Laravel.

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

Laravel is a web application framework.

Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications.

Laravel is a web application framework.

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications.

Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP.

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property.

Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function.

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing.

A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.

A vulnerability, which was classified as critical, was found in Laravel 5.1.

A vulnerability was found in laravel 5.1 and classified as problematic.

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.

OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.

Laravel is a web application framework.