EUVD-2026-115223

LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder designjson block content. Attackers can save text-editor, HTML, text or heading blocks containing...

CVE-2026-120488

LaraDashboard versions before 1.4.9 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists within the LaraBuilder design_json block content due to insufficient sanitization of input. Authenticated users possessing post.create or post.edit permissions can inject malic...

CVE-2026-120487

LaraDashboard versions prior to 1.4.5 are affected by an incorrect authorization vulnerability in the SettingPolicy::manageCoreUpgrades() function. This flaw allows non-Superadmin administrators who possess settings.edit permissions to perform restricted Superadmin-only core-upgrade operations. E...

EUVD-2026-115222

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download,...

CVE-2026-120450

LaraDashboard versions 1.4.0 before 1.4.9 are susceptible to an improper authorization vulnerability in the MCP send-email tool . Authenticated users possessing only the read-only email_template.view permission can mint an MCP token to send arbitrary emails. This allows an attacker to specify any...

EUVD-2026-115210

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only emailtemplate.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and...

LaraDashboard 1.2.2 Path Traversal

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in core-upgrade backup handling, permitting a user with settings.edit to delete arbitrary files or restore an on-disk archive into application directories. The proof of concept verifies vulnerable source markers and...

LaraDashboard 1.4.2 SVG Upload Cross Site Scripting

LaraDashboard versions 0.9.0 through 1.4.2 contain a stored cross site scripting vulnerability in SVG media uploads. Authenticated users with the media.create permission can upload an SVG whose script executes when another user opens the inline-served file. https://packetstorm.news/download/23788...

Exploit for CVE-2026-90932

CVE-2026-90932 — LaraDashboard path traversal to arbitrary fil...

Exploit for CVE-2026-90931

CVE-2026-90931 — LaraDashboard stored XSS via SVG upload En...

GHSA-g48h-h5pc-396j

GHSA-g48h-h5pc-396j — LaraDashboard path traversal to arbitrar...

EUVD-2026-92051

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

EUVD-2026-92047

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

EUVD-2026-92048

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.loginas permissions to take over accounts and...

EUVD-2026-92052

LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP daily registration limit. Attackers can send many concurrent registration requests from one IP so all pass...

EUVD-2026-92050

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirecturl parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template...

EUVD-2026-92049

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105128

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirecturl parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template...

CVE-2026-105129

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105126

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.loginas permissions to take over accounts and...