CVE-2025-54068-livewire

CVE-2025-54068 - Livewire v3.6.3 Vulnerable Lab This folder builds a minimal Laravel + Livewire v3 application pinned to Livewire 3.6.3 vulnerable for reproducing CVE-2025-54068. The mounted component is intentionally written to be compatible with the public exploit chain it allows the stage-1...

recon-test-livewire

About Laravel Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable and creative experience to be truly fulfilling. Laravel takes the pain out of development by easing common tasks used in many web projects, such as: Simple, fast routi...

POC-CVE-2026-65971

CVE-2026-65971 — SQL Injection in Livewire PowerGrid via sortDirection Proof-of-concept and full technical write-up for CVE-2026-65971 / GHSA-7fgc-3h6c-698r , an SQL injection in power-components/livewire-powergrid reachable through the public Livewire property sortDirection. | ---|--- CVE|...

Livepyre

Livepyre A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APPKEY of the Livewire project is known. Authors of the tool: @remsio @Worty. Help $ ./Livepyre.py -h usage: Livepyre.py -h -u URL -f FUNCTION -p PARAM -H HEADERS -P PROXY -a APPKEY -d -F -c Livewire exploit to...

livewire-vuln-scanner

Livewire Passive Vulnerability Scanner Livewire Passive Vulnerability Scanner is a Python 2.7 tool designed to passively detect Livewire versions used by websites and identify potential vulnerabilities based on version comparison. This scanner does not exploit any vulnerability. It only analyzes...

Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

Impact Three issues allowed actions protected by the Authorize attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. Authorize resolved a model parameter by its array key, while the action itself received parameters positionally. A...

livewire-honeypot

Livewire Honeypot A high-interaction honeypot that masquerades as a vulnerable Laravel/Livewire application. It captures exploit attempts targeting known Livewire CVEs, stores uploaded malicious files webshells and remote code execution RCE payloads with SHA-256 deduplication, and optionally...

CVE-2025-54068

CVE-2025-54068 A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APPKEY of the Livewire project is known. This tool is a recoded version of the original project by Synacktiv : Livepyre — https://github.com/synacktiv/Livepyre The core concept and methodology are based o...

Project-CVE-2025-54068

Livewire2025CVE Livewire CVE-2025-54068 Scanner Automated vulnerability scanner for detecting CVE-2025-54068 in Laravel applications using Livewire v3.0.0-beta.1 through v3.6.3. Overview This tool scans a list of websites for indicators of the critical Livewire remote code execution vulnerability...

CVE-2026-114387 Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

CVE-2026-114387

Shopper versions 2.0.0 before 2.6.0 are vulnerable to a privilege escalation flaw due to missing authorization in Livewire components. Users with only access_dashboard privileges can bypass intended restrictions by directly calling CreateTeamMember::store() or Permissions::togglePermission() via ...

CVE-2026-114387 Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

EUVD-2026-107234

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

Laravel Livewire v3 - Remote Command Execution

Livewire v3 Laravel contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution RCE without authentication under certain conditions. id: CVE-2025-54068 info: name: Laravel Livewire v3 - Remote Command Execution author: flame-11...

Laravel Livewire 3.6.3 Code Injection

Laravel Livewire versions from 3.0.0-beta.1 through 3.6.3 contain a code injection vulnerability during component property hydration that may allow unauthenticated remote code execution...

CVE-2026-110629

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded...

CVE-2026-110629

VentureDrake Laravel CRM versions prior to 2.4.0 are vulnerable to a missing authorization flaw. This vulnerability allows authenticated users to bypass Spatie role permissions by leveraging Livewire action methods . Specifically, read-only users can execute unauthorized actions such as delete, w...

CVE-2026-110629 VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded...

EUVD-2026-101257

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded...

CVE-2026-110629 VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded...