377 matches found
CVE-2018-15133-laravel-framework
CVE-2018-15133 - Laravel Framework 5.6.x Vulnerable Lab This repo provides a reproducible Docker lab for CVE-2018-15133 Laravel Framework token unserialize RCE when APPKEY is known. The app is pinned to a vulnerable Laravel 5.6.x version and exposes a simple /poc POST route under the web middlewa...
Larascript
| | | | | | / || '| / |/ | / || '|| || ' \ | | | | | | || | | | |\ | | | | || | || | || ,||| ,||/ ||| ||| ./ | || Authors: @pwnedshell & @rsgbengi 📌 What its Larascript? Larascript is a script which take advantage from CVE-2018-15133 and can execute remote commands if a vulnerable Laravel app...
EXPLOIT-CVE-2025-27515
CVE-2025-27515 Proof of Concept A practical demonstration of CVE-2025-27515 , a file upload validation bypass vulnerability in Laravel Framework ≤ 12.0.0. Vulnerability Overview CVE-2025-27515 is a validation bypass that allows attackers to circumvent file upload restrictions when Laravel...
CVE-2026-114509
CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials 🔴 CVE-2026-114509 — Laravel TokenGuard Authentication Bypass Unauthenticated Authentication Bypass in Laravel Framework — TokenGuard API Guard 📋 Overview CVE-2026-114509 is a critical authentication bypass...
OctoberCMS - Account Takeover
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...
Lab-for-cve-2018-15133
Summary: MExploiting CVE-2018-15133 Deserialization Vulnerability This exploit takes advantage of a deserialization vulnerability in the Laravel Framework through 5.5.40 and 5.6.x through 5.6.29. Description Remote code execution might occur as a result of an unserialize call on a potentially...
laravel-framework
About Laravel Note: This repository contains the core code of the Laravel framework. If you want to build an application using Laravel, visit the main Laravel repository. Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable, creative...
CVE-2021-32708
CVE-2021-32708 Affected versions of this package are vulnerable to Race Condition. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. How the Exploit Works...
CLSA-2026-1793346652 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 12.58.0-p7+tuxcare...
CLSA-2026-1793275323 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.12.3-p6+tuxcare...
PT-2026-140075
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.12.3-p6+tuxcare...
CLSA-2026-1793200604 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.50.2-p4+tuxcare...
CLSA-2026-1793193692 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.51.0-p4+tuxcare...
CLSA-2026-1793193622 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 9.52.21-p4+tuxcare...
CLSA-2026-1793190676 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 12.58.0-p6+tuxcare...
CLSA-2026-1793190457 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.83.29-p6+tuxcare...
CLSA-2026-1793190394 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.48.29-p2+tuxcare...
Laravel Framework 13.28.0 TokenGuard Authentication Bypass
Laravel Framework versions before 12.68.0 and versions 13.0.0 through 13.28.0 contain a TokenGuard authentication bypass when token-based API guards use un-hashed tokens with MySQL or MariaDB. The proof of concept demonstrates authentication as an unintended user using a non-string credential...
