CVE-2026-110239

The Rapyd Admin software versions prior to 9.20.0 is vulnerable to a stored cross-site scripting (XSS) flaw within the x-rpd::rich-text Blade component. The root cause is the component's failure to sanitize bound model values, which are instead output as raw HTML. An authenticated user can exploi...

CVE-2026-110239 Rapyd Admin before 9.20.0 Stored XSS via rich-text Component

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes...

PT-2024-40487

Name of the Vulnerable Software and Affected Versions Laravel versions prior to 7.1.2 Description The issue is related to a possible XSS attack vector in the Blade Component tag attributes. This occurs when users are allowed to dictate the value of attributes. Recommendations For versions prior t...