CVE-2021-3129

Remote Code Execution: Laravel CVE-2021-3129 📜 Description This script is designed to exploit the Remote Code Execution RCE vulnerability identified in several Laravel versions, known as CVE-2021-3129. By leveraging this vulnerability, the script allows users to write and execute commands on a...

CVE-2021-3129---Laravel-RCE

CVE-2021-3129---Laravel-RCE About The script has been made for exploiting the Laravel RCE CVE-2021-3129 vulnerability. This script allows you to write/execute commands on a website running Laravel , that has "APPDEBUG" set to "true" in its ".env" file...

EUVD-2026-91033

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled APPDEBUG=true, APPENV=local in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment,...

CVE-2026-102628 Cadmos LTI exposure of sensitive information via debug mode

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled APPDEBUG=true, APPENV=local in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment,...

Cross-site Scripting (XSS)

Overview laravel/framework is a PHP framework for web artisans. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the APPDEBUG process when attacker-controlled input is rendered in a Tippy.js tooltip with allowHTML: true. Details Cross-site scripting or XSS is a code...

EUVD-2026-88508

Laravel: XSS in Debug Page Information...

CVE-2026-102279

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279 Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279

The Laravel web application framework is vulnerable to DOM-based cross-site scripting (XSS) in versions prior to 12.69.0 and 13.30.0 . When APP_DEBUG=true , the exception debug pages pass attacker-controlled input to a Tippy.js tooltip with allowHTML set to true. This allows an attacker to execut...

PT-2026-102378

Name of the Vulnerable Software and Affected Versions Laravel versions prior to 12.69.0 Laravel versions prior to 13.30.0 Description Exception debug pages configured with APP DEBUG=true pass attacker-controlled input to a Tippy.js tooltip. Because the tooltip is configured with allowHTML set to...

Laravel Debug Enabled Detection

Laravel with APPDEBUG set to true is prone to show verbose errors. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel with APPDEBUG set to true is prone to show verbose errors.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

EUVD-2026-44349

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...

CVE-2026-47767

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...

CVE-2026-47767: Interpretation Conflict

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...