251 matches found
CVE-2026-27637
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's TokenAuth middleware uses a predictable authentication token computed as MD5userid + createdat + APPKEY. This token is static never expires/rotates, and if an attacker obtains...
CVE-2025-14894
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup proce...
CVE-2021-28254
A deserialization vulnerability in the destruct function of Laravel v8.5.9 allows attackers to execute arbitrary commands...
Exploit for Deserialization of Untrusted Data in Laravel
CVE-2018-15133 - Laravel Framework 5.6.x Vulnerable Lab Thi...
EUVD-2025-203984
Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency...
Cross-site Scripting (XSS)
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Accessory Checkout "Notes" field. An attacker can execute arbitrary JavaScript code in the context of an administrator's session by injectin...
EUVD-2025-175332
A security vulnerability has been detected in cameasy Liketea 1.0.0. Impacted is the function list of the file laravel/app/Http/Controllers/Front/StoreController.php of the component API Endpoint. Such manipulation of the argument lng/lat leads to sql injection. The attack may be performed from...
CVE-2025-64112
Statmatic is a Laravel and Git powered content management system CMS. Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fix...
PT-2025-44216
Name of the Vulnerable Software and Affected Versions Sharp versions prior to 9.11.1 Description Sharp, a content management framework for Laravel, contains a Cross-Site Scripting XSS issue in the SharpShowTextField component. Prior to version 9.11.1, expressions enclosed in & were processed by...
EUVD-2021-0727
Malware in sbrugna...
EUVD-2021-2398
Malware in sbrugna...
EUVD-2020-1471
Malware in sbrugna...
EUVD-2021-1741
Malware in sbrugna...
EUVD-2021-1945
Malware in sbrugna...
EUVD-2021-0484
Malware in sbrugna...
EUVD-2022-0712
Malicious code in bioql PyPI...
EUVD-2025-32055
Malicious code in bioql PyPI...
EUVD-2025-25449
Malicious code in bioql PyPI...