Laravel
Monthly
Stored cross-site scripting in the Shopper headless e-commerce admin panel (2.0.0 up to but not including 2.10.1, plus 3.0.0-beta.1 and beta.2) lets authenticated back-office staff who hold only a content-upload permission such as edit_products or add_brands plant HTML or SVG media that executes in an administrator's session when that administrator opens the file. Because the media is served inline from the same origin at /storage/ with no Content-Disposition or Content-Security-Policy, and because the CreateTeamMember store() flow trusts a client-supplied role_id, the injected script can mint a persistent attacker-controlled administrator account with access to customer data, orders, settings and user/role management. Exploitation requires two parties (a content editor who can upload plus an administrator who opens the file), since direct account creation by the low-privileged uploader is blocked by the access_setting check; the flaw is fixed in 2.10.1 and 3.0.0-beta.3, and the upstream GHSA advisory documents a proof-of-concept chain, but no CISA KEV listing appears in the provided data.
Permanent deletion of product variants in Shopper's admin panel is possible for any authenticated staff member who holds edit_products but not delete_product_variants in versions before 2.10.0, because the Variants Livewire component's single and bulk Filament delete actions perform no server-side authorization check (CWE-285/CWE-862). The parent product edit page gates only on edit_products, so a user can load /shopper/products/{id}/edit, obtain the signed component state, and invoke callTableAction('delete', ...) or callTableBulkAction('delete', ...) against the Livewire endpoint; impact is greatest on ProductType::Variant products, where the sellable catalogue and the storefront product pages, cart and checkout can break. Shopper 2.10.0 adds ->authorize('delete_product_variants') to both actions; a public proof-of-concept test is referenced in the advisory but is not verified as working exploit code, and no CISA KEV entry or confirmed active exploitation is reported.
Roskus Prospero Flow CRM versions 2.0.0 through 5.25.x ship user API routes (GET and DELETE /api/user/{id}) protected only by the auth:api middleware, which validates the JSON Web Token and performs no permission, policy or role check, so any holder of a basic-role account can read the account records of other users in the same company - including administrators and their email address, telephone number, postal address and IBAN - and, from 3.5.0 onward, delete those accounts. Exploitation requires a valid authenticated account (PR:L) and, for deletion of accounts outside the attacker's own company, membership in Company::DEFAULT_COMPANY (company ID 1), where the company comparison is skipped entirely; an account in that company can delete any account of any company, including a company's last administrator, and deletion removes the data held on the account. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vulnerability is tracked with an assessed CVSS 3.1 base of 8.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and is prioritized for remediation this week.
Laravel TokenGuard authentication bypass is a genuine high-priority issue, not an inflated CVSS score: unauthenticated attackers can send a crafted non-string credential, such as an array-valued api_token, to routes protected by TokenGuard and, under affected MySQL or MariaDB configurations, be matched to an unintended existing user, enabling account takeover. The flaw affects Laravel Framework before 12.68.0 and 13.x before 13.29.0 and requires the vulnerable guard plus database type-coercion behavior; no public exploit was identified at time of analysis, and vendor-released fixes are available in 12.68.0 and 13.29.0.
Unauthenticated file disclosure in LavaLite CMS through 10.1.2 allows remote attackers to download private stored files through the Filer module's filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController, exposing private local uploads or data on configured remote S3 disks when paths or disk names are known or enumerable. Publicly available exploit code exists, and no CISA KEV status is indicated in the provided data; assessed impact is confidentiality-only, with no integrity or availability effect.
Email manipulation in Krayin CRM before 2.2.7 allows authenticated users with scope-restricted Mail module access to edit, trash, or permanently delete other users' emails by enumerating sequential numeric IDs against EmailController write actions. The update path also discloses email subject, body, and linked lead and person data, and setting is_draft=0 can re-send the victim's email. The vendor fixed this in 2.2.7; no public exploit was identified at time of analysis, and the issue is moderate priority because exploitation requires a valid non-global account.
Cross-tenant access control bypass in InvoiceShelf prior to 2.4.0 lets an authenticated staff user holding only ordinary 'view notes' or 'manage notes' permissions read, modify, or delete another company's reusable invoice, estimate, and payment note templates by supplying a sequential note ID belonging to that tenant. The flaw is a classic insecure direct object reference (CWE-639) - the route-bound Note object is never handed to NotePolicy::viewNotes/manageNotes, so the policy checks only the generic ability and never validates the note's company_id, and the Note model carries no global company scope. Authentication is required (CVSS PR:L) and impact is confined to note templates rather than full financial records, but note IDs are sequential so enumeration is trivial; no public exploit code has been identified at time of analysis, and the vendor has released a fixed version (2.4.0).
Cross-tenant IDOR in InvoiceShelf before 2.4.0 lets an authenticated user with the create-invoice ability convert an estimate belonging to a different company by calling POST /api/v1/estimates/{estimate}/convert-to-invoice. Because route-model binding resolves the estimate without a company check, the attacker can copy another tenant's line items, prices, taxes, totals, notes, currency and customer data into an invoice in their own company, and the victim's configured conversion action may also modify or delete the source estimate - an exposed-data and integrity impact scored CVSS 7.1 with PR:L, requiring an authenticated account. Exploitation is only meaningful on multi-company (multi-tenant) deployments and no public exploit code has been identified at time of analysis; the vendor-released fix is version 2.4.0.
Rapyd Admin 9.0.0 through 9.19.x lets an authenticated company member holding the default `customer` role hijack arbitrary accounts through the Livewire `UsersModalEditEmbed` component: `editUser`, `save` and `deleteUser` trust a user id supplied by the browser and validate only a permission, so a low-privileged member can reset an owner's or super admin's password, promote themselves to `owner`, and delete users. Exploitation requires a logged-in account with the default `customer` role (which carries `edit own users`) and predictable sequential user ids - per the vendor changelog public self-registration is open, so any attacker can obtain that role, and no other non-default configuration is needed. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); vendor-released fix: 9.20.0 (the changelog attributes the security release to 9.19.0).
Unauthenticated remote attackers can seize global super-admin control of Rapyd Admin installations running versions 9.0.0 through 9.19.x, because the framework's setup installer seeds a hard-coded administrator account (admin@laravel, password 'admin') that grants the highest privilege level in the application. The account is silently re-created on every execution of the `rpd:make` artisan command, so an operator who previously changed the password or removed the account can have the known credential restored without warning, and a successful login bypasses per-record authorization checks and multi-tenant scoping entirely. VulnCheck disclosed the issue with full source references, no public exploit code was identified at time of analysis, and no evidence of confirmed active exploitation (CISA KEV) is present; the vendor shipped the fix in v9.20.0, which creates the first admin once with a random password and never re-seeds it.
Databasement instances before 1.8.2 allow an authenticated user to achieve remote code execution by injecting path-redirecting client options (such as mariadb-dump --result-file, -r, --tab, pg_dump --file, mongodump --out, or redis-cli --rdb/--eval) into the arguments passed to the backup dump binary. Shell quoting prevents classic OS command injection, but argument injection alone is sufficient: by directing the dump output to a web-served, PHP-executing path such as /app/public/index.php, the attacker writes code that the web server later executes. Authentication is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), publicly available exploit code exists, and success depends on the chosen output path being both web-accessible and interpretable as code; no evidence of confirmed active exploitation was provided.
Directory traversal in WookTeam 1.6.6 and earlier lets a remote attacker read arbitrary files from the server through the /api/project/task/export endpoint by supplying the data parameter with a crafted JSON payload whose file value contains ../ sequences, which are concatenated into storage_path() and streamed back via response()->download(). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), so the flaw is treated as unauthenticated and read-only, though the independent assessment flags that real-world deployments of this team-collaboration app may require a session to reach the export route and defenders should confirm whether their instance exposes it pre-authentication. Exploitation pressure currently looks low - EPSS is only 0.21% (11th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis, even though a public technical write-up of the file-read behavior is linked from the CVE record; the practical risk is limited to files readable by the web-server process user.
The alexpechkarev/google-maps Laravel package through version 12.16 ships with TLS certificate verification turned off by default: the bundled config file sets ssl_verify_peer to FALSE, which is handed straight to CURLOPT_SSL_VERIFYPEER, so any Laravel application using the package without overriding the config will accept any certificate presented by the Google Maps web-service endpoint. An attacker who occupies an on-path position between the application server and Google (hostile Wi-Fi, rogue proxy, DNS or ARP spoofing, or a compromised upstream hop) can therefore terminate a fake TLS session, read the Google Maps API key carried in the request query string, and modify geocoding or map responses returned to the application. Exploitation requires no authentication and no user interaction, but the on-path vantage point is the limiting factor; no public exploit code was identified at time of analysis, and the vulnerability is not confirmed actively exploited (not in CISA KEV).
Misconfigured Laravel debug mode in the hosted Cadmos LTI application at cadmos.eummena.io exposes the entire server environment - the full plaintext .env file with database credentials, application keys, and third-party service secrets - to any remote attacker who can trigger an unhandled exception with a single GET request. No authentication or user interaction is required (CVSS 4.0 base 9.2; independent assessment CVSS 3.1 9.2, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), but the issue is configuration-dependent rather than a default-everywhere flaw: only deployments left with APP_DEBUG=true and APP_ENV=local in a publicly reachable environment are exploitable. The operator remediated the affected hosted instance on or before 2026-09-02, and no public exploit code has been identified at time of analysis.
Broken access control in Liberu CRM 0.9.1 through releases before 10.0.0 lets an authenticated low-privileged user who already holds a pending team invitation escalate privileges and bind a second, attacker-controlled account to the team with full admin rights, granting create, read, update, and delete access over all team-scoped data. The root cause is a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invite rights based solely on whether the requesting email matches an outstanding invitation, combined with missing privilege-level validation in InviteTeamMember, so a POST to the team-invitations route specifying the 'admin' role is accepted. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 10.0.0, which removes the flaw.
Authenticated path traversal in Laranode before 1.2.1 lets any tenant holding a valid account and file manager access write arbitrary files outside their own home directory via the POST /filemanager/upload-file endpoint, including dropping PHP files into other tenants' web roots for code execution as those tenants. The endpoint built its destination as '/home/' + systemUsername + '/' + user-supplied path with no normalization or containment, so a low-complexity traversal request is sufficient on multi-tenant hosts where the web server interprets the written PHP; vendor CVSS 4.0 rates this 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) equally reflects cross-tenant scope change. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV entry); exploitation requires authentication, so single-tenant installations limit the blast radius to the attacker's own account.
Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can edit a rich-text Editor field persist JavaScript via the iframe srcdoc attribute; the payload executes in the browser of any other user - typically a higher-privileged administrator - who later views the stored content, enabling session hijacking, account takeover, privilege escalation or disclosure of administrative data. The vendor confirmed the issue in advisory GHSA-qxg3-46rw-79j8 and shipped a fix in version 9.22.5 (commit ec509a22) that removes srcdoc from the permitted iframe attributes; exploitation requires a valid account with Editor-field edit permission and a second viewing victim (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3). There is no indication of active exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can submit content into a SharpEditorFormField persist executable markup that later runs in the browser of anyone who opens the stored record, including higher-privileged administrators. The bug is that markup carrying the data-html-content attribute - and, before the fix, iframe srcdoc - survived the framework's server-side sanitization even when the SharpFormEditorField::RAW_HTML toolbar button was not enabled (CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C, published base 8.7; our assessment rates the integrity/confidentiality consequences lower, C:L/I:L). No public exploit code or confirmed active exploitation was identified at time of analysis, but exploitation requires only a low-privileged editor-level account on the Sharp admin panel plus a victim viewing the poisoned record.
Unauthenticated file upload in Laravel-Mediable 7.0.0 and 7.0.1 lets a remote attacker upload a .pht file that passes MediaUploader::verifyExtension() and File::sanitizeFileName(), which is then written to disk and executed as PHP when requested on Apache servers configured with the Debian/Ubuntu default FilesMatch handler, resulting in remote code execution as the web server process. The flaw is an incomplete fix for CVE-2026-49972: the forbidden_extensions list added in config/mediable.php blocks phpt but omits pht, an Apache-recognized PHP extension. Vendor-released patch 7.0.2 closes the gap; no public exploit code was identified at time of analysis, but exploitation is trivial where the upload endpoint is reachable and unauthenticated, so the issue warrants high priority despite the platform-specific precondition.
Authenticated users of Many Notes versions prior to 0.16.0 can exploit the ZIP vault import routine to write or overwrite arbitrary files outside their own vault and into other users' vaults, because archive entry names containing parent-directory ('..') segments are not rejected. The same primitive lets an attacker plant a disguised SVG file in a victim's vault that executes stored cross-site scripting once the victim opens that vault, so the flaw matters primarily on multi-user deployments. The integrity impact of the cross-user file write is unconditional and requires no victim interaction, while the confidentiality impact of the stored XSS is limited by the need for the victim to open the affected vault and for the browser to render the SVG; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing).
Path traversal leading to remote code execution in LaraDashboard 0.9.2-1.2.2 allows an authenticated user holding only the delegated settings.edit permission to delete arbitrary host-filesystem files or restore a ZIP archive from any on-disk location, writing arbitrary content into application directories and achieving code execution. CoreUpgradeController and BackupService::deleteBackup() concatenate user-supplied filename parameters directly onto the storage/app/core-backups base path without normalization, basename() sanitization, or boundary verification - and the associated form requests validate only string length, not path content. No patched version was available at time of publication; no public exploit has been identified at time of analysis.
CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound email processing in any application that passes user-supplied email addresses to Laravel's mail functions. An attacker who can provide an email address to an application flow - such as registration, password reset, or contact forms - can embed carriage-return/line-feed sequences to inject additional SMTP headers, reroute messages to unintended recipients, or abuse the application's mail infrastructure as an open relay. The vendor has released patches in versions 12.60.0 and 13.10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Laravel Socialite's Facebook provider (versions before 5.29.0) lets unauthenticated remote attackers replay captured OIDC id_tokens because getUserByOIDCToken() in FacebookProvider.php validates signature, aud, and iss but never checks a session-bound nonce. An attacker holding any valid, unexpired id_token minted for the same Facebook App ID can submit it to the backend's userFromToken() endpoint and be logged in as the victim, achieving full account takeover. Reported by VulnCheck and assigned CVSS 4.0 9.2; no public exploit has been identified at time of analysis and it is not on CISA KEV.
Authentication bypass in Laravel Passport 13.0.0-13.7.0 allows machine-to-machine OAuth2 client_credentials tokens to impersonate arbitrary application users. The league/oauth2-server library sets JWT sub claim to client identifier for M2M flows; Passport's token guard fails to validate this identifier represents an actual user before passing to retrieveById(), enabling any M2M token to authenticate as unrelated real users. Affects all deployments using client_credentials grant type. Requires low-privilege authenticated access (PR:L). No public exploit identified at time of analysis.
Access control bypass in Winter CMS before 1.0.477/1.1.12/1.2.12. CVSS 9.9.
File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.
Statmatic is a Laravel and Git powered content management system (CMS). [CVSS 8.7 HIGH]
Authenticated Statamic CMS users (versions 6.0.0-6.3.x) can bypass privilege escalation verification checks to gain unauthorized elevated access, potentially enabling unauthorized sensitive operations depending on existing permissions. The vulnerability affects both Statamic and its Laravel framework integration, with a patch available in version 6.4.0.
Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers to predict reset tokens and take over accounts. PoC and patch available.
Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that bypass file upload restrictions, enabling arbitrary code execution on Apache servers with `AllowOverride All` enabled. Public exploit code exists for this vulnerability. The attack requires valid user credentials but affects all FreeScout installations using the vulnerable PHP Laravel framework configuration.
Password reset poisoning in Statamic CMS before 6.3.3/5.73.10 allows attackers to steal password reset tokens by manipulating the Host header in reset requests. Patch available.
Authenticated users with content creation permissions in Statamic CMS versions 6.0.0 through 6.2.2 can inject persistent JavaScript through content titles that executes in the browsers of higher-privileged users, potentially allowing attackers to create unauthorized super admin accounts. The vulnerability affects users with control panel access and requires user interaction to trigger. A patch is available in version 6.2.3.
Laravel Reverb WebSocket server versions 1.6.3 and below have an insecure deserialization vulnerability enabling remote code execution on the backend server.
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting malicious HTTP requests, enabling persistent JavaScript injection that executes when administrators view or edit pages. Public exploit code exists for this vulnerability, creating high-risk scenarios including admin account compromise and backend system hijacking. Bagisto versions prior to 2.3.10 are affected, and no patch is currently available for the underlying Laravel platform.
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like CVE-2026-21448, this enables remote code execution through the Blade template engine. Patch available in 2.3.10.
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable first and last name fields, allowing low-privilege authenticated users to achieve remote code execution. This high-severity vulnerability (CVSS 8.8) affects confidentiality, integrity, and availability with public exploit code available and no patch currently deployed. Organizations running affected Bagisto instances should immediately upgrade to version 2.3.10 or later.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address fields during checkout. A normal customer can inject Blade template code that executes when viewed in the admin panel, achieving RCE. PoC available.
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available.
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) that allows unauthenticated attackers to execute commands through improper hydration of component property updates. KEV-listed with EPSS 16%, this vulnerability affects one of the most popular PHP frameworks, potentially compromising thousands of Laravel applications using Livewire for reactive server-side rendering.
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 88.8%.
Shopper versions prior to 2.10.1 expose administrator and staff profile records to low-privileged admin-panel users through an insecure direct object reference in the customer detail route `/cpanel/customers/{user}/show`. Any account holding `access_dashboard` and `read_customers` can substitute an arbitrary user ID and receive profile data for accounts that the separate team-management interface protects behind the stronger `view_users` permission; differing 200/403/404 responses also permit user-ID enumeration, and if the same role holds `delete_customers` the `anonymizeAction()` may operate on the unrestricted loaded user model. Exploitation requires a valid authenticated staff session (PR:L) and same-table staff/customer accounts, and the vendor advisory ships a step-by-step proof-of-concept reproduction; the trigger is an ordinary authenticated request with a modified URL path segment rather than any special product configuration.
Crafted relationship-inclusion parameters on Laravel JSON:API resource endpoints can be turned into destructive database operations, letting a low-privileged user wipe data from related tables through what should be a read-only request. Applications running laravel/framework versions 12.45.0 through 12.67.x, or 13.x before 13.27.0, that expose client-controlled 'include' query parameters via the JsonApiResource / ResolvesJsonApiElements feature are affected; the vendor fixed the flaw in 12.68.0 and 13.27.0. Because a single request can irreversibly empty tables, the integrity and availability impact outweighs the modest attack complexity, though exploitation is conditional on JSON:API resources actually being adopted and on the endpoint honoring user-supplied includes - no public exploit code or confirmed active exploitation was identified at time of analysis.
Unrestricted file upload in the PHP-based file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) lets remote users submit attacker-controlled files through the File parameter handled by FileController::store; the practical impact ranges from stored malicious content to code execution only if uploads are web-accessible and executable by the server. Publicly available exploit code exists, the report was filed with the project but no response is noted, and no CISA KEV entry is present. Authentication requirements are not confirmed from the available data-the authoritative assessment uses a CVSS 3.1 vector with PR:L, while the supplied CVSS 4.0 vector claims PR:N-so the endpoint should be treated as reachable by remote users and potentially requiring a valid low-privileged session.
Missing authorization in the Scheduled Restore component of David-Crty Databasement 1.8.1 and earlier lets an authenticated user supply an arbitrary schema_name value to the SaveScheduledRestoreRequest API endpoint and thereby schedule restore operations against database schemas they are not authorized to manage. Exploitation is network-reachable but requires a valid privileged session on the instance plus the Scheduled Restore feature being in use, and public exploit code exists per the vendor GitHub security advisory. The issue is fixed in release 1.8.2; impact per the assessed vector is limited to low confidentiality, integrity and availability effects on the appliance's own scope.
Stored cross-site scripting in Rapyd Admin before 9.20.0 allows any authenticated low-privilege user to persist JavaScript through a x-rpd::rich-text Livewire-bound property, which then executes in an administrator's browser session when that record's form is opened in the admin panel. Exploitation requires a valid low-privilege account plus a subsequent administrator interaction, which substantially limits real-world risk, and the vendor scores the flaw at CVSS 4.0 base 2.1 while an independent assessment rates it around CVSS 3.1 6.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis. A vendor-released patch exists in 9.20.0 (fix commit acd6ee85), which sanitises rich-text output through HTMLPurifier.
Stored cross-site scripting in zofe/rapyd-admin (Rapyd Admin) 9.4.0 before 9.20.0 lets an unauthenticated attacker who can self-register pick a display name containing HTML/JavaScript, which the x-rpd::select-list Blade component renders unescaped and which then executes in a privileged administrator's browser session - specifically when the admin opens Logs → Activity (Author filter) or the users and permissions forms. The CVSS vector confirms PR:N (no authentication) but UI:P/UI:R, so exploitation depends on open self-service registration plus an administrator viewing the affected screen; impact is confined to the admin's browser session, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the vendor addressed it in 9.20.0 by escaping the option labels and rejecting names containing '<' or '>'.
Race condition in LaraDashboard 1.4.0 through 1.4.7 allows unauthenticated remote attackers to bypass the per-IP daily registration limit by flooding concurrent registration requests, so that every request passes RegistrationGuardService::hasExceededIpLimit before any recordRegistration call commits. The result is bulk account creation that defeats the product's anti-automation and anti-spam controls, with impact limited to integrity of the registration state (no confidentiality or availability effect). Exploitation requires that public self-registration is enabled and the per-IP cap is active, and it depends on winning a narrow TOCTOU window, so attack complexity is high; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. EPSS data was not provided, but the assessed severity is low-to-moderate rather than critical.
Path traversal in LaraDashboard before 1.4.8 lets unauthenticated remote attackers read arbitrary JSON files from the application by manipulating the {lang} segment of the public /api/translations/{lang} endpoint. Because the route concatenates the user-supplied value into a filesystem path and appends '.json', an attacker on a Windows host can submit URL-encoded backslash sequences such as ..%5C to escape the resources/lang directory and retrieve files like composer.json or version.json, exposing dependency and version metadata. The impact is limited to confidentiality (read-only, JSON files only) with no write or code execution, and no public exploit code was identified at time of analysis; a vendor fix is available in v1.4.8.
Missing current-password confirmation in Filament's app-based multi-factor authentication management actions (set-up, disable, regenerate recovery codes) allows an attacker who already holds an authenticated user session to enroll a new TOTP authenticator and harvest fresh recovery codes, or to disable existing app-based MFA and regenerate its recovery codes, by supplying only an existing valid app code or recovery code. The flaw affects Filament 4.0.0 through <4.13.3 and the 5.x line before 5.8.3, carrying a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - the required authenticated session, per the independent assessment, is the limiting factor, and there is no path to unauthenticated sign-in through this issue. There is no public exploit identified at time of analysis and no CISA KEV listing; vendor-released patches exist in 4.13.3 and 5.8.3.
Path traversal in David-Crty databasement up to 1.7.1 lets a high-privileged authenticated user escape the intended backup volume by supplying a crafted schema_name to the database-servers restore API endpoint, reaching filesystem locations outside the restore target. The attack is network-reachable but rated high-complexity and difficult to exploit, and its assessed impact is limited to low confidentiality, integrity and availability with no scope change. Publicly available exploit code exists, though there is no confirmed evidence of active exploitation; the issue is fixed in 1.7.2.
Cache poisoning in UnoPim before 2.0.1 and 2.1.x before 2.1.1 allows unauthenticated remote attackers to inject an arbitrary origin into admin layout pages by sending a crafted X-Forwarded-Host header, because the application trusts every connecting client as a proxy and never validates the header. When a shared caching proxy or CDN stores the poisoned admin response, a subsequent administrator loading that page has the admin UI's JavaScript assets resolved from the attacker's server, executing attacker-supplied code inside an authenticated session. Exploitation is conditional - it requires an intermediary cache in front of admin responses and an administrator visiting the poisoned page (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C, with limited confidentiality and integrity impact), no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 4.0 base score is 2.3.
DOM-based cross-site scripting in Laravel's built-in exception debug renderer (Laravel framework before 12.69.0 and 13.30.0) lets attacker-influenced data be rendered as HTML inside a Tippy.js tooltip on the debug page, so script executes in the browser of anyone who views that page and hovers the affected tooltip. The issue is reachable unauthenticated over the network (CVSS vector PR:N) but requires user interaction (UI:R) and only manifests when the application is running with APP_DEBUG=true - a configuration Laravel does not recommend for production - which is the principal limiting factor and keeps the overall severity at Low (CVSS 3.1). No public exploit code has been identified at time of analysis, and vendor-released patches exist in 12.69.0 and 13.30.0.
Bagisto up to 2.4.6 fails to enforce authorization on the invoice mass status update endpoint, allowing an authenticated admin-panel user to alter invoice states. The impact is limited to integrity changes (CVSS 2.0 / 3.1 3.9), and although publicly available exploit code exists, the need for valid admin-context credentials reduces the overall risk to low. The vendor was contacted early about the disclosure, but no patched version has been identified.
Server-side request forgery (SSRF) in October CMS 4.3.4 and earlier allows unauthenticated remote attackers to bypass the validateExternalImageHost protection in System/Classes/ResizeImages.php by supplying a crafted IPv6-mapped IPv4 host, causing the server to fetch attacker-controlled or internal URLs. Publicly available exploit code exists (no CISA KEV confirmation of active exploitation), and the assessed impact is a largely blind SSRF with Low confidentiality, integrity and availability impact, so real-world severity depends on what internal services or cloud metadata endpoints the server can reach. October CMS 4.3.5 resolves the bypass; the issue is genuine but should be treated as low-to-moderate priority.
Incomplete scheme validation in October CMS's image resizer (getSourcePathForResize() in modules/system/classes/ResizeImages.php) allows non-HTTP PHP stream wrappers such as phar://, file:// and ftp:// to be stored in the resize cache and later handed to the underlying image library, producing a server-side request forgery condition that on phar:// paths can trigger metadata deserialization during subsequent file operations. Affected builds are 4.1.x up to 4.1.19, 4.2.x up to 4.2.25 and 4.3.0 through 4.3.4; upgrading to 4.3.5 or 4.4.0 resolves the issue (patch commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58). Publicly available exploit code exists (reported by 0xGenesi, tracked as CVE-2026-100909), but no confirmed active exploitation has been observed; reachability is narrow because the flaw only matters where a pre-existing injection primitive already pipes untrusted input into the |resize Twig filter or the ResizeImages::resize() API without validating the scheme, so default templates and trusted-value usages (uploaded file models, theme assets, static URLs) are not exposed.
SQL injection in the Timesheet Dashboard of DevaslanPHP project-management (versions 1.2.1, 1.2.2, 1.2.3, 1.2.4 and v2.0.0-beta1) lets an authenticated remote attacker with a valid low-privileged account manipulate the 'filter' argument consumed by whereRaw() in app/Filament/Widgets/Timesheet/MonthlyReport.php and inject SQL against the application's backend database. Publicly available exploit code exists (a proof-of-concept write-up is published on GitHub), so the technique is within reach of moderately skilled attackers, although exploitation still requires a working session on the instance. The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis; the vendor-assigned CVSS 4.0 base score is 5.3 (Medium), while our independent assessment rates the confidentiality impact High with only limited integrity impact.
Authenticated SQL injection in the DevaslanPHP project-management Timesheet Dashboard (versions 1.2.1 through 1.2.4 and 2.0.0-beta1) allows a low-privilege logged-in user to inject arbitrary SQL through the `filter` argument consumed by the whereRaw() call in app/Filament/Widgets/Timesheet/ActivitiesReport.php, exposing or altering backend database data. Publicly available exploit code exists (a GitHub write-up demonstrating the Timesheet Dashboard Chart Filter injection, and the CVSS 4.0 vector carries E:P), and no CISA KEV entry indicates confirmed active exploitation. The vendor was contacted but did not respond, so no patched release has been confirmed and the disclosure is tracked via VulDB.
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm) 2.2.4 and earlier because the CanInstall middleware and InstallerController never abort once the application has already been installed, an authorization bypass that allows installer functionality to be re-driven on a live instance. Publicly available exploit code exists (a published advisory demonstrating an unauthenticated installer bypass), though there is no confirmed active exploitation (not in CISA KEV); the assessed vector is network-reachable, no privileges, no user interaction, with low confidentiality, integrity, and availability impact. Only self-hosted deployments left network-reachable with the Installer package present are exposed, and the vendor has released a patched version.
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to download email attachments belonging to other mailboxes simply by supplying a different attachment ID to the admin attachment-download endpoint. Exploitation requires only a valid low-privileged account on the admin panel, causes confidentiality loss only (no modification or denial of service), and publicly available exploit code exists, which the CVSS 4.0 vector reflects via its E:P (proof-of-concept) exploit maturity rating. Vendor-released patch: 2.2.6, which enforces the mail.view permission on the download action.
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access administrative functions whose routes are missing from the ACL map, including warehouse settings left unprotected by a route-name typo. The pre-2.2.6 Bouncer middleware failed open for unmapped admin routes, so an attacker who already holds valid admin-backend credentials can invoke functions outside their intended role; publicly available exploit code exists, and upgrading to 2.2.6 fixes the issue. Impact is confined to individual unmapped admin functions rather than full system compromise, making this a moderate-severity broken-access-control flaw.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user to upload an SVG file containing embedded JavaScript that is written to the application's public disk and served from the application origin, so the script executes in a victim's browser session when the uploaded file's direct URL is opened. Successful exploitation enables theft of session cookies and CSRF tokens, giving the attacker the ability to act as the victim within the ERP; independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (vendor score 5.1), reflecting a cross-site scripted response that requires a second user to open the crafted file URL. Exploitation prerequisites are non-trivial - the attacker must hold an authenticated account with access to a file-upload field and the victim must navigate to the stored file - and no public exploit identified at time of analysis, so this is best handled as a standard patch-cycle item rather than an emergency.
Missing authorization in Shopper Framework's Livewire Media component (`Media.store()`) allows any authenticated staff user holding only `browse_products` to overwrite product thumbnail and gallery images without the required `edit_products` permission. This is an incomplete fix: the prior patch for GHSA-h4mp-g9c6-xwph (commit fcd0c59) added `#[Locked]` to the `$product` property but omitted the `authorize()` call present in the five sibling components it did repair (Edit, Inventory, Seo, Shipping, Files). A fully functional proof-of-concept is included in the advisory; vendor-released patch is version 2.9.2. No public exploit identifier at time of analysis beyond the advisory PoC.
Statamic CMS versions before 5.73.11 and 6.4.0 expose user email addresses through the user fieldtype data endpoint to authenticated users lacking "view users" permissions, allowing information disclosure. An authenticated attacker with limited privileges can retrieve sensitive email information that should be restricted, potentially enabling targeted attacks or account enumeration.
Statmatic is a Laravel and Git powered content management system (CMS). [CVSS 6.8 MEDIUM]
Stored XSS in TypiCMS prior to version 16.1.7 allows authenticated users to upload malicious SVG files that execute JavaScript in administrators' browsers, compromising their sessions through unsanitized file content. Public exploit code exists for this vulnerability affecting Laravel-based TypiCMS installations. The flaw stems from insufficient validation of SVG file contents despite MIME type checks being present.
Statamic versions prior to 5.73.6 and 6.2.5 allow authenticated users without asset viewing permissions to download and access asset metadata through improper access controls. Only users with valid control panel access can exploit this vulnerability, as logged-out users are unaffected. A patch is available in the fixed versions.
Unauthenticated directory traversal in the Laravel Voyager admin package (the-control-group/voyager) version 1.3.0 allows remote attackers to read arbitrary files from the server by manipulating the asset path parameter on the /admin/voyager-assets endpoint, exposing sensitive content such as /etc/passwd and Laravel .env configuration files. Exploitation requires only that a vulnerable instance be deployed with the voyager-assets route reachable over the network; according to the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), no credentials, user interaction, or special configuration are needed, and the impact is read-only information disclosure with no direct write or code-execution path. Publicly available exploit code exists (Exploit-DB 47875 and a ProjectDiscovery Nuclei template), so weaponized tooling is readily obtainable, though there is no confirmed actively exploited (CISA KEV) status and EPSS is modest at 0.30% (53rd percentile), placing this as a credible, actionable issue rather than an emergency.
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization.
Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtain sensitive application secrets and tenant data.
PsySH versions prior to 0.11.23 and 0.12.19 automatically execute a `.psysh.php` file from the current working directory during startup, allowing local attackers with write access to a directory to achieve arbitrary code execution when a user launches PsySH from that location. When a privileged user such as root or a CI runner executes PsySH in an attacker-controlled directory, this results in local privilege escalation. Public exploit code exists for this vulnerability and no patch is currently available.
Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server. [CVSS 6.5 MEDIUM]
Livewire Filemanager for Laravel contains an unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary files on the server.
Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the symlinked valet command to execute arbitrary code with root permissions without additional authentication. [CVSS 8.4 HIGH]
Recovery codes used as a fallback for app-based (TOTP) multi-factor authentication in Filament 4.0.0 through 4.3.0 are never consumed when redeemed, so a single code keeps working indefinitely instead of once. The practical impact is that an attacker who already holds a victim's valid password plus one leaked or observed recovery code can keep satisfying the MFA challenge and log in repeatedly, effectively converting a one-time backup credential into a permanent second-factor bypass; email-based MFA and installations with recovery codes disabled are not affected. This is a conditional rather than a readily exploitable flaw: there is no public exploit identified at time of analysis, EPSS is low (~0.34%, 26th percentile), no CISA KEV listing exists, and exploitation requires the prior compromise of both credentials and a recovery code, which is why the CVSS vector carries AC:H despite a PR:N rating.
Host-header injection in LaraDashboard 2.3.0 and earlier allows remote attackers to poison the administrator password-reset link and redirect the reset token to an attacker-controlled host, enabling admin account takeover and, via the module installer, arbitrary PHP code execution. The reset URL is built with url(route(...)) rather than config('app.url'), so a crafted Host header controls the link; token capture still depends on administrator interaction or mail prefetching, and RCE requires module upload after takeover. No public exploit identified at time of analysis; vendor patch commit/advisory exist, and EPSS is 0.11% (29th percentile).
Stored cross-site scripting in Sharp CMS (the code16/sharp package for Laravel) before 9.11.1 lets an authenticated user with a writable data path inject Vue template expressions that execute JavaScript in a victim administrator's browser whenever the affected SharpShowTextField is displayed. The root cause is that values wrapped in {{ and }} rendered by the SharpShowTextField component were compiled and evaluated by Vue's runtime template compiler rather than being shown as literal text, so a payload such as {{ Math.random() }} executes on view. Per the CVSS vector (PR:L, UI:R), exploitation requires an authenticated account or another writable data path feeding the field, and a victim must load the show view; EPSS is low at 0.22% (11th percentile) and no public exploit code was identified at time of analysis, though the upstream fix commit and PR are public.
Stored cross-site scripting in Code16 Sharp 9.6.6 lets an authenticated back-office user upload an SVG carrying embedded script, which then executes in the browser of anyone who later views or renders that asset in the Sharp admin interface. The flaw sits in src/Form/Fields/SharpFormUploadField.php, which in 9.6.6 saves uploaded SVGs without sanitization, so exploitation requires both access to an upload form and a victim opening the stored file (UI:R). Sharp 9.7.0 flips the defaults to sanitize SVGs and saved HTML; EPSS is 0.33% (25th percentile) with no CISA KEV entry, and a public vulnerability-research reference exists but is not verified as working exploit code.
Server-side template injection in Bagisto 2.3.7 lets an authenticated backend user with product-creation privileges inject Blade template expressions through product descriptions, potentially achieving remote code execution and access to sensitive application data. Exploitation requires a high-privileged account and is triggered when the product description is rendered or previewed; publicly available exploit code exists, but the available data does not indicate confirmed active exploitation via CISA KEV. EPSS is low at 0.40% (33rd percentile), so priority should be driven by exposure of product-management accounts, and the vendor-released fix is Bagisto 2.3.8.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote Code Execution (RCE) in vulnerable configurations. The vulnerability allows unauthenticated network attackers to execute arbitrary commands on the server, access sensitive environment variables, and escalate privileges without requiring user interaction or special access. With a perfect CVSS 3.1 score of 10.0 and network-based attack vector, this represents a critical threat to all unpatched LaRecipe installations.
Laravel is a web application framework. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Laravel is a web application framework. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Stored cross-site scripting in the Shopper headless e-commerce admin panel (2.0.0 up to but not including 2.10.1, plus 3.0.0-beta.1 and beta.2) lets authenticated back-office staff who hold only a content-upload permission such as edit_products or add_brands plant HTML or SVG media that executes in an administrator's session when that administrator opens the file. Because the media is served inline from the same origin at /storage/ with no Content-Disposition or Content-Security-Policy, and because the CreateTeamMember store() flow trusts a client-supplied role_id, the injected script can mint a persistent attacker-controlled administrator account with access to customer data, orders, settings and user/role management. Exploitation requires two parties (a content editor who can upload plus an administrator who opens the file), since direct account creation by the low-privileged uploader is blocked by the access_setting check; the flaw is fixed in 2.10.1 and 3.0.0-beta.3, and the upstream GHSA advisory documents a proof-of-concept chain, but no CISA KEV listing appears in the provided data.
Permanent deletion of product variants in Shopper's admin panel is possible for any authenticated staff member who holds edit_products but not delete_product_variants in versions before 2.10.0, because the Variants Livewire component's single and bulk Filament delete actions perform no server-side authorization check (CWE-285/CWE-862). The parent product edit page gates only on edit_products, so a user can load /shopper/products/{id}/edit, obtain the signed component state, and invoke callTableAction('delete', ...) or callTableBulkAction('delete', ...) against the Livewire endpoint; impact is greatest on ProductType::Variant products, where the sellable catalogue and the storefront product pages, cart and checkout can break. Shopper 2.10.0 adds ->authorize('delete_product_variants') to both actions; a public proof-of-concept test is referenced in the advisory but is not verified as working exploit code, and no CISA KEV entry or confirmed active exploitation is reported.
Roskus Prospero Flow CRM versions 2.0.0 through 5.25.x ship user API routes (GET and DELETE /api/user/{id}) protected only by the auth:api middleware, which validates the JSON Web Token and performs no permission, policy or role check, so any holder of a basic-role account can read the account records of other users in the same company - including administrators and their email address, telephone number, postal address and IBAN - and, from 3.5.0 onward, delete those accounts. Exploitation requires a valid authenticated account (PR:L) and, for deletion of accounts outside the attacker's own company, membership in Company::DEFAULT_COMPANY (company ID 1), where the company comparison is skipped entirely; an account in that company can delete any account of any company, including a company's last administrator, and deletion removes the data held on the account. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vulnerability is tracked with an assessed CVSS 3.1 base of 8.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and is prioritized for remediation this week.
Laravel TokenGuard authentication bypass is a genuine high-priority issue, not an inflated CVSS score: unauthenticated attackers can send a crafted non-string credential, such as an array-valued api_token, to routes protected by TokenGuard and, under affected MySQL or MariaDB configurations, be matched to an unintended existing user, enabling account takeover. The flaw affects Laravel Framework before 12.68.0 and 13.x before 13.29.0 and requires the vulnerable guard plus database type-coercion behavior; no public exploit was identified at time of analysis, and vendor-released fixes are available in 12.68.0 and 13.29.0.
Unauthenticated file disclosure in LavaLite CMS through 10.1.2 allows remote attackers to download private stored files through the Filer module's filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController, exposing private local uploads or data on configured remote S3 disks when paths or disk names are known or enumerable. Publicly available exploit code exists, and no CISA KEV status is indicated in the provided data; assessed impact is confidentiality-only, with no integrity or availability effect.
Email manipulation in Krayin CRM before 2.2.7 allows authenticated users with scope-restricted Mail module access to edit, trash, or permanently delete other users' emails by enumerating sequential numeric IDs against EmailController write actions. The update path also discloses email subject, body, and linked lead and person data, and setting is_draft=0 can re-send the victim's email. The vendor fixed this in 2.2.7; no public exploit was identified at time of analysis, and the issue is moderate priority because exploitation requires a valid non-global account.
Cross-tenant access control bypass in InvoiceShelf prior to 2.4.0 lets an authenticated staff user holding only ordinary 'view notes' or 'manage notes' permissions read, modify, or delete another company's reusable invoice, estimate, and payment note templates by supplying a sequential note ID belonging to that tenant. The flaw is a classic insecure direct object reference (CWE-639) - the route-bound Note object is never handed to NotePolicy::viewNotes/manageNotes, so the policy checks only the generic ability and never validates the note's company_id, and the Note model carries no global company scope. Authentication is required (CVSS PR:L) and impact is confined to note templates rather than full financial records, but note IDs are sequential so enumeration is trivial; no public exploit code has been identified at time of analysis, and the vendor has released a fixed version (2.4.0).
Cross-tenant IDOR in InvoiceShelf before 2.4.0 lets an authenticated user with the create-invoice ability convert an estimate belonging to a different company by calling POST /api/v1/estimates/{estimate}/convert-to-invoice. Because route-model binding resolves the estimate without a company check, the attacker can copy another tenant's line items, prices, taxes, totals, notes, currency and customer data into an invoice in their own company, and the victim's configured conversion action may also modify or delete the source estimate - an exposed-data and integrity impact scored CVSS 7.1 with PR:L, requiring an authenticated account. Exploitation is only meaningful on multi-company (multi-tenant) deployments and no public exploit code has been identified at time of analysis; the vendor-released fix is version 2.4.0.
Rapyd Admin 9.0.0 through 9.19.x lets an authenticated company member holding the default `customer` role hijack arbitrary accounts through the Livewire `UsersModalEditEmbed` component: `editUser`, `save` and `deleteUser` trust a user id supplied by the browser and validate only a permission, so a low-privileged member can reset an owner's or super admin's password, promote themselves to `owner`, and delete users. Exploitation requires a logged-in account with the default `customer` role (which carries `edit own users`) and predictable sequential user ids - per the vendor changelog public self-registration is open, so any attacker can obtain that role, and no other non-default configuration is needed. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); vendor-released fix: 9.20.0 (the changelog attributes the security release to 9.19.0).
Unauthenticated remote attackers can seize global super-admin control of Rapyd Admin installations running versions 9.0.0 through 9.19.x, because the framework's setup installer seeds a hard-coded administrator account (admin@laravel, password 'admin') that grants the highest privilege level in the application. The account is silently re-created on every execution of the `rpd:make` artisan command, so an operator who previously changed the password or removed the account can have the known credential restored without warning, and a successful login bypasses per-record authorization checks and multi-tenant scoping entirely. VulnCheck disclosed the issue with full source references, no public exploit code was identified at time of analysis, and no evidence of confirmed active exploitation (CISA KEV) is present; the vendor shipped the fix in v9.20.0, which creates the first admin once with a random password and never re-seeds it.
Databasement instances before 1.8.2 allow an authenticated user to achieve remote code execution by injecting path-redirecting client options (such as mariadb-dump --result-file, -r, --tab, pg_dump --file, mongodump --out, or redis-cli --rdb/--eval) into the arguments passed to the backup dump binary. Shell quoting prevents classic OS command injection, but argument injection alone is sufficient: by directing the dump output to a web-served, PHP-executing path such as /app/public/index.php, the attacker writes code that the web server later executes. Authentication is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), publicly available exploit code exists, and success depends on the chosen output path being both web-accessible and interpretable as code; no evidence of confirmed active exploitation was provided.
Directory traversal in WookTeam 1.6.6 and earlier lets a remote attacker read arbitrary files from the server through the /api/project/task/export endpoint by supplying the data parameter with a crafted JSON payload whose file value contains ../ sequences, which are concatenated into storage_path() and streamed back via response()->download(). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), so the flaw is treated as unauthenticated and read-only, though the independent assessment flags that real-world deployments of this team-collaboration app may require a session to reach the export route and defenders should confirm whether their instance exposes it pre-authentication. Exploitation pressure currently looks low - EPSS is only 0.21% (11th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis, even though a public technical write-up of the file-read behavior is linked from the CVE record; the practical risk is limited to files readable by the web-server process user.
The alexpechkarev/google-maps Laravel package through version 12.16 ships with TLS certificate verification turned off by default: the bundled config file sets ssl_verify_peer to FALSE, which is handed straight to CURLOPT_SSL_VERIFYPEER, so any Laravel application using the package without overriding the config will accept any certificate presented by the Google Maps web-service endpoint. An attacker who occupies an on-path position between the application server and Google (hostile Wi-Fi, rogue proxy, DNS or ARP spoofing, or a compromised upstream hop) can therefore terminate a fake TLS session, read the Google Maps API key carried in the request query string, and modify geocoding or map responses returned to the application. Exploitation requires no authentication and no user interaction, but the on-path vantage point is the limiting factor; no public exploit code was identified at time of analysis, and the vulnerability is not confirmed actively exploited (not in CISA KEV).
Misconfigured Laravel debug mode in the hosted Cadmos LTI application at cadmos.eummena.io exposes the entire server environment - the full plaintext .env file with database credentials, application keys, and third-party service secrets - to any remote attacker who can trigger an unhandled exception with a single GET request. No authentication or user interaction is required (CVSS 4.0 base 9.2; independent assessment CVSS 3.1 9.2, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), but the issue is configuration-dependent rather than a default-everywhere flaw: only deployments left with APP_DEBUG=true and APP_ENV=local in a publicly reachable environment are exploitable. The operator remediated the affected hosted instance on or before 2026-09-02, and no public exploit code has been identified at time of analysis.
Broken access control in Liberu CRM 0.9.1 through releases before 10.0.0 lets an authenticated low-privileged user who already holds a pending team invitation escalate privileges and bind a second, attacker-controlled account to the team with full admin rights, granting create, read, update, and delete access over all team-scoped data. The root cause is a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invite rights based solely on whether the requesting email matches an outstanding invitation, combined with missing privilege-level validation in InviteTeamMember, so a POST to the team-invitations route specifying the 'admin' role is accepted. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 10.0.0, which removes the flaw.
Authenticated path traversal in Laranode before 1.2.1 lets any tenant holding a valid account and file manager access write arbitrary files outside their own home directory via the POST /filemanager/upload-file endpoint, including dropping PHP files into other tenants' web roots for code execution as those tenants. The endpoint built its destination as '/home/' + systemUsername + '/' + user-supplied path with no normalization or containment, so a low-complexity traversal request is sufficient on multi-tenant hosts where the web server interprets the written PHP; vendor CVSS 4.0 rates this 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) equally reflects cross-tenant scope change. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV entry); exploitation requires authentication, so single-tenant installations limit the blast radius to the attacker's own account.
Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can edit a rich-text Editor field persist JavaScript via the iframe srcdoc attribute; the payload executes in the browser of any other user - typically a higher-privileged administrator - who later views the stored content, enabling session hijacking, account takeover, privilege escalation or disclosure of administrative data. The vendor confirmed the issue in advisory GHSA-qxg3-46rw-79j8 and shipped a fix in version 9.22.5 (commit ec509a22) that removes srcdoc from the permitted iframe attributes; exploitation requires a valid account with Editor-field edit permission and a second viewing victim (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3). There is no indication of active exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can submit content into a SharpEditorFormField persist executable markup that later runs in the browser of anyone who opens the stored record, including higher-privileged administrators. The bug is that markup carrying the data-html-content attribute - and, before the fix, iframe srcdoc - survived the framework's server-side sanitization even when the SharpFormEditorField::RAW_HTML toolbar button was not enabled (CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C, published base 8.7; our assessment rates the integrity/confidentiality consequences lower, C:L/I:L). No public exploit code or confirmed active exploitation was identified at time of analysis, but exploitation requires only a low-privileged editor-level account on the Sharp admin panel plus a victim viewing the poisoned record.
Unauthenticated file upload in Laravel-Mediable 7.0.0 and 7.0.1 lets a remote attacker upload a .pht file that passes MediaUploader::verifyExtension() and File::sanitizeFileName(), which is then written to disk and executed as PHP when requested on Apache servers configured with the Debian/Ubuntu default FilesMatch handler, resulting in remote code execution as the web server process. The flaw is an incomplete fix for CVE-2026-49972: the forbidden_extensions list added in config/mediable.php blocks phpt but omits pht, an Apache-recognized PHP extension. Vendor-released patch 7.0.2 closes the gap; no public exploit code was identified at time of analysis, but exploitation is trivial where the upload endpoint is reachable and unauthenticated, so the issue warrants high priority despite the platform-specific precondition.
Authenticated users of Many Notes versions prior to 0.16.0 can exploit the ZIP vault import routine to write or overwrite arbitrary files outside their own vault and into other users' vaults, because archive entry names containing parent-directory ('..') segments are not rejected. The same primitive lets an attacker plant a disguised SVG file in a victim's vault that executes stored cross-site scripting once the victim opens that vault, so the flaw matters primarily on multi-user deployments. The integrity impact of the cross-user file write is unconditional and requires no victim interaction, while the confidentiality impact of the stored XSS is limited by the need for the victim to open the affected vault and for the browser to render the SVG; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing).
Path traversal leading to remote code execution in LaraDashboard 0.9.2-1.2.2 allows an authenticated user holding only the delegated settings.edit permission to delete arbitrary host-filesystem files or restore a ZIP archive from any on-disk location, writing arbitrary content into application directories and achieving code execution. CoreUpgradeController and BackupService::deleteBackup() concatenate user-supplied filename parameters directly onto the storage/app/core-backups base path without normalization, basename() sanitization, or boundary verification - and the associated form requests validate only string length, not path content. No patched version was available at time of publication; no public exploit has been identified at time of analysis.
CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound email processing in any application that passes user-supplied email addresses to Laravel's mail functions. An attacker who can provide an email address to an application flow - such as registration, password reset, or contact forms - can embed carriage-return/line-feed sequences to inject additional SMTP headers, reroute messages to unintended recipients, or abuse the application's mail infrastructure as an open relay. The vendor has released patches in versions 12.60.0 and 13.10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Laravel Socialite's Facebook provider (versions before 5.29.0) lets unauthenticated remote attackers replay captured OIDC id_tokens because getUserByOIDCToken() in FacebookProvider.php validates signature, aud, and iss but never checks a session-bound nonce. An attacker holding any valid, unexpired id_token minted for the same Facebook App ID can submit it to the backend's userFromToken() endpoint and be logged in as the victim, achieving full account takeover. Reported by VulnCheck and assigned CVSS 4.0 9.2; no public exploit has been identified at time of analysis and it is not on CISA KEV.
Authentication bypass in Laravel Passport 13.0.0-13.7.0 allows machine-to-machine OAuth2 client_credentials tokens to impersonate arbitrary application users. The league/oauth2-server library sets JWT sub claim to client identifier for M2M flows; Passport's token guard fails to validate this identifier represents an actual user before passing to retrieveById(), enabling any M2M token to authenticate as unrelated real users. Affects all deployments using client_credentials grant type. Requires low-privilege authenticated access (PR:L). No public exploit identified at time of analysis.
Access control bypass in Winter CMS before 1.0.477/1.1.12/1.2.12. CVSS 9.9.
File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.
Statmatic is a Laravel and Git powered content management system (CMS). [CVSS 8.7 HIGH]
Authenticated Statamic CMS users (versions 6.0.0-6.3.x) can bypass privilege escalation verification checks to gain unauthorized elevated access, potentially enabling unauthorized sensitive operations depending on existing permissions. The vulnerability affects both Statamic and its Laravel framework integration, with a patch available in version 6.4.0.
Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers to predict reset tokens and take over accounts. PoC and patch available.
Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that bypass file upload restrictions, enabling arbitrary code execution on Apache servers with `AllowOverride All` enabled. Public exploit code exists for this vulnerability. The attack requires valid user credentials but affects all FreeScout installations using the vulnerable PHP Laravel framework configuration.
Password reset poisoning in Statamic CMS before 6.3.3/5.73.10 allows attackers to steal password reset tokens by manipulating the Host header in reset requests. Patch available.
Authenticated users with content creation permissions in Statamic CMS versions 6.0.0 through 6.2.2 can inject persistent JavaScript through content titles that executes in the browsers of higher-privileged users, potentially allowing attackers to create unauthorized super admin accounts. The vulnerability affects users with control panel access and requires user interaction to trigger. A patch is available in version 6.2.3.
Laravel Reverb WebSocket server versions 1.6.3 and below have an insecure deserialization vulnerability enabling remote code execution on the backend server.
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting malicious HTTP requests, enabling persistent JavaScript injection that executes when administrators view or edit pages. Public exploit code exists for this vulnerability, creating high-risk scenarios including admin account compromise and backend system hijacking. Bagisto versions prior to 2.3.10 are affected, and no patch is currently available for the underlying Laravel platform.
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like CVE-2026-21448, this enables remote code execution through the Blade template engine. Patch available in 2.3.10.
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable first and last name fields, allowing low-privilege authenticated users to achieve remote code execution. This high-severity vulnerability (CVSS 8.8) affects confidentiality, integrity, and availability with public exploit code available and no patch currently deployed. Organizations running affected Bagisto instances should immediately upgrade to version 2.3.10 or later.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address fields during checkout. A normal customer can inject Blade template code that executes when viewed in the admin panel, achieving RCE. PoC available.
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available.
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) that allows unauthenticated attackers to execute commands through improper hydration of component property updates. KEV-listed with EPSS 16%, this vulnerability affects one of the most popular PHP frameworks, potentially compromising thousands of Laravel applications using Livewire for reactive server-side rendering.
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 88.8%.
Shopper versions prior to 2.10.1 expose administrator and staff profile records to low-privileged admin-panel users through an insecure direct object reference in the customer detail route `/cpanel/customers/{user}/show`. Any account holding `access_dashboard` and `read_customers` can substitute an arbitrary user ID and receive profile data for accounts that the separate team-management interface protects behind the stronger `view_users` permission; differing 200/403/404 responses also permit user-ID enumeration, and if the same role holds `delete_customers` the `anonymizeAction()` may operate on the unrestricted loaded user model. Exploitation requires a valid authenticated staff session (PR:L) and same-table staff/customer accounts, and the vendor advisory ships a step-by-step proof-of-concept reproduction; the trigger is an ordinary authenticated request with a modified URL path segment rather than any special product configuration.
Crafted relationship-inclusion parameters on Laravel JSON:API resource endpoints can be turned into destructive database operations, letting a low-privileged user wipe data from related tables through what should be a read-only request. Applications running laravel/framework versions 12.45.0 through 12.67.x, or 13.x before 13.27.0, that expose client-controlled 'include' query parameters via the JsonApiResource / ResolvesJsonApiElements feature are affected; the vendor fixed the flaw in 12.68.0 and 13.27.0. Because a single request can irreversibly empty tables, the integrity and availability impact outweighs the modest attack complexity, though exploitation is conditional on JSON:API resources actually being adopted and on the endpoint honoring user-supplied includes - no public exploit code or confirmed active exploitation was identified at time of analysis.
Unrestricted file upload in the PHP-based file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) lets remote users submit attacker-controlled files through the File parameter handled by FileController::store; the practical impact ranges from stored malicious content to code execution only if uploads are web-accessible and executable by the server. Publicly available exploit code exists, the report was filed with the project but no response is noted, and no CISA KEV entry is present. Authentication requirements are not confirmed from the available data-the authoritative assessment uses a CVSS 3.1 vector with PR:L, while the supplied CVSS 4.0 vector claims PR:N-so the endpoint should be treated as reachable by remote users and potentially requiring a valid low-privileged session.
Missing authorization in the Scheduled Restore component of David-Crty Databasement 1.8.1 and earlier lets an authenticated user supply an arbitrary schema_name value to the SaveScheduledRestoreRequest API endpoint and thereby schedule restore operations against database schemas they are not authorized to manage. Exploitation is network-reachable but requires a valid privileged session on the instance plus the Scheduled Restore feature being in use, and public exploit code exists per the vendor GitHub security advisory. The issue is fixed in release 1.8.2; impact per the assessed vector is limited to low confidentiality, integrity and availability effects on the appliance's own scope.
Stored cross-site scripting in Rapyd Admin before 9.20.0 allows any authenticated low-privilege user to persist JavaScript through a x-rpd::rich-text Livewire-bound property, which then executes in an administrator's browser session when that record's form is opened in the admin panel. Exploitation requires a valid low-privilege account plus a subsequent administrator interaction, which substantially limits real-world risk, and the vendor scores the flaw at CVSS 4.0 base 2.1 while an independent assessment rates it around CVSS 3.1 6.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis. A vendor-released patch exists in 9.20.0 (fix commit acd6ee85), which sanitises rich-text output through HTMLPurifier.
Stored cross-site scripting in zofe/rapyd-admin (Rapyd Admin) 9.4.0 before 9.20.0 lets an unauthenticated attacker who can self-register pick a display name containing HTML/JavaScript, which the x-rpd::select-list Blade component renders unescaped and which then executes in a privileged administrator's browser session - specifically when the admin opens Logs → Activity (Author filter) or the users and permissions forms. The CVSS vector confirms PR:N (no authentication) but UI:P/UI:R, so exploitation depends on open self-service registration plus an administrator viewing the affected screen; impact is confined to the admin's browser session, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the vendor addressed it in 9.20.0 by escaping the option labels and rejecting names containing '<' or '>'.
Race condition in LaraDashboard 1.4.0 through 1.4.7 allows unauthenticated remote attackers to bypass the per-IP daily registration limit by flooding concurrent registration requests, so that every request passes RegistrationGuardService::hasExceededIpLimit before any recordRegistration call commits. The result is bulk account creation that defeats the product's anti-automation and anti-spam controls, with impact limited to integrity of the registration state (no confidentiality or availability effect). Exploitation requires that public self-registration is enabled and the per-IP cap is active, and it depends on winning a narrow TOCTOU window, so attack complexity is high; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. EPSS data was not provided, but the assessed severity is low-to-moderate rather than critical.
Path traversal in LaraDashboard before 1.4.8 lets unauthenticated remote attackers read arbitrary JSON files from the application by manipulating the {lang} segment of the public /api/translations/{lang} endpoint. Because the route concatenates the user-supplied value into a filesystem path and appends '.json', an attacker on a Windows host can submit URL-encoded backslash sequences such as ..%5C to escape the resources/lang directory and retrieve files like composer.json or version.json, exposing dependency and version metadata. The impact is limited to confidentiality (read-only, JSON files only) with no write or code execution, and no public exploit code was identified at time of analysis; a vendor fix is available in v1.4.8.
Missing current-password confirmation in Filament's app-based multi-factor authentication management actions (set-up, disable, regenerate recovery codes) allows an attacker who already holds an authenticated user session to enroll a new TOTP authenticator and harvest fresh recovery codes, or to disable existing app-based MFA and regenerate its recovery codes, by supplying only an existing valid app code or recovery code. The flaw affects Filament 4.0.0 through <4.13.3 and the 5.x line before 5.8.3, carrying a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - the required authenticated session, per the independent assessment, is the limiting factor, and there is no path to unauthenticated sign-in through this issue. There is no public exploit identified at time of analysis and no CISA KEV listing; vendor-released patches exist in 4.13.3 and 5.8.3.
Path traversal in David-Crty databasement up to 1.7.1 lets a high-privileged authenticated user escape the intended backup volume by supplying a crafted schema_name to the database-servers restore API endpoint, reaching filesystem locations outside the restore target. The attack is network-reachable but rated high-complexity and difficult to exploit, and its assessed impact is limited to low confidentiality, integrity and availability with no scope change. Publicly available exploit code exists, though there is no confirmed evidence of active exploitation; the issue is fixed in 1.7.2.
Cache poisoning in UnoPim before 2.0.1 and 2.1.x before 2.1.1 allows unauthenticated remote attackers to inject an arbitrary origin into admin layout pages by sending a crafted X-Forwarded-Host header, because the application trusts every connecting client as a proxy and never validates the header. When a shared caching proxy or CDN stores the poisoned admin response, a subsequent administrator loading that page has the admin UI's JavaScript assets resolved from the attacker's server, executing attacker-supplied code inside an authenticated session. Exploitation is conditional - it requires an intermediary cache in front of admin responses and an administrator visiting the poisoned page (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C, with limited confidentiality and integrity impact), no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 4.0 base score is 2.3.
DOM-based cross-site scripting in Laravel's built-in exception debug renderer (Laravel framework before 12.69.0 and 13.30.0) lets attacker-influenced data be rendered as HTML inside a Tippy.js tooltip on the debug page, so script executes in the browser of anyone who views that page and hovers the affected tooltip. The issue is reachable unauthenticated over the network (CVSS vector PR:N) but requires user interaction (UI:R) and only manifests when the application is running with APP_DEBUG=true - a configuration Laravel does not recommend for production - which is the principal limiting factor and keeps the overall severity at Low (CVSS 3.1). No public exploit code has been identified at time of analysis, and vendor-released patches exist in 12.69.0 and 13.30.0.
Bagisto up to 2.4.6 fails to enforce authorization on the invoice mass status update endpoint, allowing an authenticated admin-panel user to alter invoice states. The impact is limited to integrity changes (CVSS 2.0 / 3.1 3.9), and although publicly available exploit code exists, the need for valid admin-context credentials reduces the overall risk to low. The vendor was contacted early about the disclosure, but no patched version has been identified.
Server-side request forgery (SSRF) in October CMS 4.3.4 and earlier allows unauthenticated remote attackers to bypass the validateExternalImageHost protection in System/Classes/ResizeImages.php by supplying a crafted IPv6-mapped IPv4 host, causing the server to fetch attacker-controlled or internal URLs. Publicly available exploit code exists (no CISA KEV confirmation of active exploitation), and the assessed impact is a largely blind SSRF with Low confidentiality, integrity and availability impact, so real-world severity depends on what internal services or cloud metadata endpoints the server can reach. October CMS 4.3.5 resolves the bypass; the issue is genuine but should be treated as low-to-moderate priority.
Incomplete scheme validation in October CMS's image resizer (getSourcePathForResize() in modules/system/classes/ResizeImages.php) allows non-HTTP PHP stream wrappers such as phar://, file:// and ftp:// to be stored in the resize cache and later handed to the underlying image library, producing a server-side request forgery condition that on phar:// paths can trigger metadata deserialization during subsequent file operations. Affected builds are 4.1.x up to 4.1.19, 4.2.x up to 4.2.25 and 4.3.0 through 4.3.4; upgrading to 4.3.5 or 4.4.0 resolves the issue (patch commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58). Publicly available exploit code exists (reported by 0xGenesi, tracked as CVE-2026-100909), but no confirmed active exploitation has been observed; reachability is narrow because the flaw only matters where a pre-existing injection primitive already pipes untrusted input into the |resize Twig filter or the ResizeImages::resize() API without validating the scheme, so default templates and trusted-value usages (uploaded file models, theme assets, static URLs) are not exposed.
SQL injection in the Timesheet Dashboard of DevaslanPHP project-management (versions 1.2.1, 1.2.2, 1.2.3, 1.2.4 and v2.0.0-beta1) lets an authenticated remote attacker with a valid low-privileged account manipulate the 'filter' argument consumed by whereRaw() in app/Filament/Widgets/Timesheet/MonthlyReport.php and inject SQL against the application's backend database. Publicly available exploit code exists (a proof-of-concept write-up is published on GitHub), so the technique is within reach of moderately skilled attackers, although exploitation still requires a working session on the instance. The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis; the vendor-assigned CVSS 4.0 base score is 5.3 (Medium), while our independent assessment rates the confidentiality impact High with only limited integrity impact.
Authenticated SQL injection in the DevaslanPHP project-management Timesheet Dashboard (versions 1.2.1 through 1.2.4 and 2.0.0-beta1) allows a low-privilege logged-in user to inject arbitrary SQL through the `filter` argument consumed by the whereRaw() call in app/Filament/Widgets/Timesheet/ActivitiesReport.php, exposing or altering backend database data. Publicly available exploit code exists (a GitHub write-up demonstrating the Timesheet Dashboard Chart Filter injection, and the CVSS 4.0 vector carries E:P), and no CISA KEV entry indicates confirmed active exploitation. The vendor was contacted but did not respond, so no patched release has been confirmed and the disclosure is tracked via VulDB.
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm) 2.2.4 and earlier because the CanInstall middleware and InstallerController never abort once the application has already been installed, an authorization bypass that allows installer functionality to be re-driven on a live instance. Publicly available exploit code exists (a published advisory demonstrating an unauthenticated installer bypass), though there is no confirmed active exploitation (not in CISA KEV); the assessed vector is network-reachable, no privileges, no user interaction, with low confidentiality, integrity, and availability impact. Only self-hosted deployments left network-reachable with the Installer package present are exposed, and the vendor has released a patched version.
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to download email attachments belonging to other mailboxes simply by supplying a different attachment ID to the admin attachment-download endpoint. Exploitation requires only a valid low-privileged account on the admin panel, causes confidentiality loss only (no modification or denial of service), and publicly available exploit code exists, which the CVSS 4.0 vector reflects via its E:P (proof-of-concept) exploit maturity rating. Vendor-released patch: 2.2.6, which enforces the mail.view permission on the download action.
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access administrative functions whose routes are missing from the ACL map, including warehouse settings left unprotected by a route-name typo. The pre-2.2.6 Bouncer middleware failed open for unmapped admin routes, so an attacker who already holds valid admin-backend credentials can invoke functions outside their intended role; publicly available exploit code exists, and upgrading to 2.2.6 fixes the issue. Impact is confined to individual unmapped admin functions rather than full system compromise, making this a moderate-severity broken-access-control flaw.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user to upload an SVG file containing embedded JavaScript that is written to the application's public disk and served from the application origin, so the script executes in a victim's browser session when the uploaded file's direct URL is opened. Successful exploitation enables theft of session cookies and CSRF tokens, giving the attacker the ability to act as the victim within the ERP; independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (vendor score 5.1), reflecting a cross-site scripted response that requires a second user to open the crafted file URL. Exploitation prerequisites are non-trivial - the attacker must hold an authenticated account with access to a file-upload field and the victim must navigate to the stored file - and no public exploit identified at time of analysis, so this is best handled as a standard patch-cycle item rather than an emergency.
Missing authorization in Shopper Framework's Livewire Media component (`Media.store()`) allows any authenticated staff user holding only `browse_products` to overwrite product thumbnail and gallery images without the required `edit_products` permission. This is an incomplete fix: the prior patch for GHSA-h4mp-g9c6-xwph (commit fcd0c59) added `#[Locked]` to the `$product` property but omitted the `authorize()` call present in the five sibling components it did repair (Edit, Inventory, Seo, Shipping, Files). A fully functional proof-of-concept is included in the advisory; vendor-released patch is version 2.9.2. No public exploit identifier at time of analysis beyond the advisory PoC.
Statamic CMS versions before 5.73.11 and 6.4.0 expose user email addresses through the user fieldtype data endpoint to authenticated users lacking "view users" permissions, allowing information disclosure. An authenticated attacker with limited privileges can retrieve sensitive email information that should be restricted, potentially enabling targeted attacks or account enumeration.
Statmatic is a Laravel and Git powered content management system (CMS). [CVSS 6.8 MEDIUM]
Stored XSS in TypiCMS prior to version 16.1.7 allows authenticated users to upload malicious SVG files that execute JavaScript in administrators' browsers, compromising their sessions through unsanitized file content. Public exploit code exists for this vulnerability affecting Laravel-based TypiCMS installations. The flaw stems from insufficient validation of SVG file contents despite MIME type checks being present.
Statamic versions prior to 5.73.6 and 6.2.5 allow authenticated users without asset viewing permissions to download and access asset metadata through improper access controls. Only users with valid control panel access can exploit this vulnerability, as logged-out users are unaffected. A patch is available in the fixed versions.
Unauthenticated directory traversal in the Laravel Voyager admin package (the-control-group/voyager) version 1.3.0 allows remote attackers to read arbitrary files from the server by manipulating the asset path parameter on the /admin/voyager-assets endpoint, exposing sensitive content such as /etc/passwd and Laravel .env configuration files. Exploitation requires only that a vulnerable instance be deployed with the voyager-assets route reachable over the network; according to the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), no credentials, user interaction, or special configuration are needed, and the impact is read-only information disclosure with no direct write or code-execution path. Publicly available exploit code exists (Exploit-DB 47875 and a ProjectDiscovery Nuclei template), so weaponized tooling is readily obtainable, though there is no confirmed actively exploited (CISA KEV) status and EPSS is modest at 0.30% (53rd percentile), placing this as a credible, actionable issue rather than an emergency.
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization.
Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtain sensitive application secrets and tenant data.
PsySH versions prior to 0.11.23 and 0.12.19 automatically execute a `.psysh.php` file from the current working directory during startup, allowing local attackers with write access to a directory to achieve arbitrary code execution when a user launches PsySH from that location. When a privileged user such as root or a CI runner executes PsySH in an attacker-controlled directory, this results in local privilege escalation. Public exploit code exists for this vulnerability and no patch is currently available.
Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server. [CVSS 6.5 MEDIUM]
Livewire Filemanager for Laravel contains an unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary files on the server.
Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the symlinked valet command to execute arbitrary code with root permissions without additional authentication. [CVSS 8.4 HIGH]
Recovery codes used as a fallback for app-based (TOTP) multi-factor authentication in Filament 4.0.0 through 4.3.0 are never consumed when redeemed, so a single code keeps working indefinitely instead of once. The practical impact is that an attacker who already holds a victim's valid password plus one leaked or observed recovery code can keep satisfying the MFA challenge and log in repeatedly, effectively converting a one-time backup credential into a permanent second-factor bypass; email-based MFA and installations with recovery codes disabled are not affected. This is a conditional rather than a readily exploitable flaw: there is no public exploit identified at time of analysis, EPSS is low (~0.34%, 26th percentile), no CISA KEV listing exists, and exploitation requires the prior compromise of both credentials and a recovery code, which is why the CVSS vector carries AC:H despite a PR:N rating.
Host-header injection in LaraDashboard 2.3.0 and earlier allows remote attackers to poison the administrator password-reset link and redirect the reset token to an attacker-controlled host, enabling admin account takeover and, via the module installer, arbitrary PHP code execution. The reset URL is built with url(route(...)) rather than config('app.url'), so a crafted Host header controls the link; token capture still depends on administrator interaction or mail prefetching, and RCE requires module upload after takeover. No public exploit identified at time of analysis; vendor patch commit/advisory exist, and EPSS is 0.11% (29th percentile).
Stored cross-site scripting in Sharp CMS (the code16/sharp package for Laravel) before 9.11.1 lets an authenticated user with a writable data path inject Vue template expressions that execute JavaScript in a victim administrator's browser whenever the affected SharpShowTextField is displayed. The root cause is that values wrapped in {{ and }} rendered by the SharpShowTextField component were compiled and evaluated by Vue's runtime template compiler rather than being shown as literal text, so a payload such as {{ Math.random() }} executes on view. Per the CVSS vector (PR:L, UI:R), exploitation requires an authenticated account or another writable data path feeding the field, and a victim must load the show view; EPSS is low at 0.22% (11th percentile) and no public exploit code was identified at time of analysis, though the upstream fix commit and PR are public.
Stored cross-site scripting in Code16 Sharp 9.6.6 lets an authenticated back-office user upload an SVG carrying embedded script, which then executes in the browser of anyone who later views or renders that asset in the Sharp admin interface. The flaw sits in src/Form/Fields/SharpFormUploadField.php, which in 9.6.6 saves uploaded SVGs without sanitization, so exploitation requires both access to an upload form and a victim opening the stored file (UI:R). Sharp 9.7.0 flips the defaults to sanitize SVGs and saved HTML; EPSS is 0.33% (25th percentile) with no CISA KEV entry, and a public vulnerability-research reference exists but is not verified as working exploit code.
Server-side template injection in Bagisto 2.3.7 lets an authenticated backend user with product-creation privileges inject Blade template expressions through product descriptions, potentially achieving remote code execution and access to sensitive application data. Exploitation requires a high-privileged account and is triggered when the product description is rendered or previewed; publicly available exploit code exists, but the available data does not indicate confirmed active exploitation via CISA KEV. EPSS is low at 0.40% (33rd percentile), so priority should be driven by exposure of product-management accounts, and the vendor-released fix is Bagisto 2.3.8.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote Code Execution (RCE) in vulnerable configurations. The vulnerability allows unauthenticated network attackers to execute arbitrary commands on the server, access sensitive environment variables, and escalate privileges without requiring user interaction or special access. With a perfect CVSS 3.1 score of 10.0 and network-based attack vector, this represents a critical threat to all unpatched LaRecipe installations.
Laravel is a web application framework. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Laravel is a web application framework. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.