cve.bz

laravel framework vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 2.3CVE-2026-128083

    Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concu…

  2. 9.2CVE-2026-114509ExploitEPSS 1.8%

    Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentica…

  3. 6.5CVE-2026-114508EPSS 0.4%

    Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with …

  4. 3.1CVE-2026-102279EPSS 0.3%

    Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scri…

  5. 8.9CVE-2026-48019EPSS 0.5%

    Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may al…

  6. 6.1CVE-2024-13919EPSS 0.5%

    The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.

  7. 6.1CVE-2024-13918EPSS 0.6%

    The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

  8. 6.9CVE-2025-27515EPSS 0.7%

    Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.4…

  9. 8.7CVE-2024-52301EPSS 45%

    Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the re…

  10. 5.3CVE-2022-40482EPSS 0.9%

    The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials …

  11. 8.8CVE-2020-19316EPSS 2.5%

    OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.

  12. 6.1CVE-2021-43808EPSS 0.8%

    Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user tak…

  13. 9.8CVE-2021-43617ExploitEPSS 20%

    Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on…

  14. 8.8CVE-2018-6330EPSS 1.6%

    Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters.