Framework

CVE-2026-48019 Sep 04, 22:11 HIGH PATCH This Week

CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound email processing in any application that passes user-supplied email addresses to Laravel's mail functions. An attacker who can provide an email address to an application flow - such as registration, password reset, or contact forms - can embed carriage-return/line-feed sequences to inject additional SMTP headers, reroute messages to unintended recipients, or abuse the application's mail infrastructure as an open relay. The vendor has released patches in versions 12.60.0 and 13.10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.

CVE-2026-73661 Aug 13, 21:25 HIGH PATCH This Week

FreePBX Framework's restore functionality allows an authenticated user with backup-restore privileges to inject the hidden AUTHTYPE=none configuration setting via a crafted backup archive, completely disabling web administration authentication on the affected PBX. Versions prior to 16.0.47 (branch 16) and 17.0.30 (branch 17) are confirmed affected; vendor patches have been released. No public exploit identified at time of analysis, though the fix commit diff publicly reveals the exact attack technique against a widely deployed telephony platform.

CVE-2026-78654 Aug 25, 06:00 MEDIUM POC PATCH This Month

Prototype pollution in the `@cleverbrush/deep` package (versions ≤ 4.4.0) allows a remote attacker to corrupt `Object.prototype` by supplying crafted JSON containing reserved JavaScript keys (`__proto__`, `constructor`, `prototype`) to the `deepExtend()` function without any privilege requirement. Any Node.js application that passes externally controlled input through `deepExtend()` is at risk of property injection affecting every plain object in the runtime, potentially enabling authentication bypass or logic manipulation downstream. A public exploit exists (GitHub issue #213); the vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed at time of analysis.

CVE-2026-41887 May 08, 15:50 PHP MEDIUM PATCH This Month

Authenticated administrators in Flarum can read arbitrary files and trigger server-side request forgery via LESS injection in theme color settings. The vulnerability exploits an incomplete patch for CVE-2023-27577 that restricted @import and data-uri() only in the custom_less setting but failed to apply the same restrictions to other LESS config variables such as theme_primary_color and theme_secondary_color. An attacker with admin credentials can inject arbitrary @import directives into compiled forum.css, exposing sensitive files or making outbound HTTP requests to internal networks and cloud metadata endpoints. Vendor-released patches: Flarum 1.8.16 and 2.0.0-rc.1.

CVE-2025-30148 Apr 10, 13:15 PHP MEDIUM PATCH This Month

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2025-27515 Mar 05, 19:15 PHP MEDIUM PATCH This Month

Laravel is a web application framework. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-53277 Jan 14, 23:15 PHP MEDIUM PATCH This Month

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-52301 Nov 12, 20:15 PHP HIGH PATCH This Week

Laravel is a web application framework. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-9443 Nov 05, 09:15 MEDIUM PATCH This Month

The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.0 due to insufficient input sanitization and. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-32981 Jul 17, 20:15 PHP MEDIUM PATCH This Month

Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-4337 Apr 30, 10:15 HIGH This Week

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/admin/nav/add, in multiple parameters. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-4336 Apr 30, 10:15 HIGH This Week

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/admin/tables/add, in multiple parameters. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-22729 Apr 26, 15:15 PHP MEDIUM PATCH This Month

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.

CVE-2023-22728 Apr 26, 14:15 PHP MEDIUM PATCH This Month

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2022-4414 Dec 12, 00:15 MEDIUM PATCH This Month

Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-4413 Dec 12, 00:15 MEDIUM POC PATCH This Month

Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2022-38147 Nov 23, 03:15 PHP MEDIUM PATCH This Month

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-38145 Nov 23, 02:15 PHP MEDIUM PATCH This Month

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-37430 Nov 23, 02:15 PHP MEDIUM PATCH This Month

Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-37429 Nov 23, 02:15 PHP MEDIUM PATCH This Month

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-38724 Nov 23, 00:15 PHP MEDIUM POC PATCH This Month

Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2022-38462 Nov 22, 13:15 PHP MEDIUM PATCH This Month

Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-38148 Nov 21, 16:15 PHP HIGH PATCH This Week

Silverstripe silverstripe/framework through 4.11 allows SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-38146 Nov 21, 16:15 PHP MEDIUM PATCH This Month

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-25238 Jun 28, 22:15 PHP MEDIUM PATCH This Month

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-43808 Dec 08, 00:15 PHP MEDIUM POC PATCH This Month

Laravel is a web application framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2021-43617 Nov 14, 16:15 CRITICAL POC PATCH THREAT Act Now

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.

CVE-2020-7991 Jan 26, 22:15 HIGH POC This Week

Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-7990 Jan 26, 22:15 MEDIUM POC This Month

Adive Framework 2.0.8 has admin/user/add userName XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-7989 Jan 26, 22:15 MEDIUM POC This Month

Adive Framework 2.0.8 has admin/user/add userUsername XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-14987 Aug 13, 04:15 MEDIUM This Month

Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.