CVE-2020-24940

7.5 highEPSS 1.2%

High (7.5) in laravel laravel. EPSS 1.2% chance of exploitation in the next 30 days.

An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2020-09-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

laravel:laravel

References

https://blog.laravel.com/security-release-laravel-61834-7232
https://blog.laravel.com/security-release-laravel-61834-7232

Check your stack JSON