210 matches found
CVE-2019-17050
An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary files, such as the .env file. NOTE: a software maintainer has suggested a solution in which Compass is switched off in a production environme...
VulnCheck KEV: CVE-2019-17050
An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary files, such as the .env file. NOTE: a software maintainer has suggested a solution in which Compass is switched off in a production environme...
OS Command Injection
tcg/voyager is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation of input passed to a specific PHP Artisan command, allowing authenticated administrators to execute arbitrary OS commands in Laravel 8 or later...
CVE-2025-32931
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...
Arbitrary Argument Injection
Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via a specific php artisan command at the /admin/compass endpoint. An attacker can execute arbitrary OS commands by injecting arguments into the command execution process. This is only exploitable if the...
GHSA-QQ2H-M2HJ-HRFF DevDojo Voyager Argument Injection vulnerability
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...
DevDojo Voyager Argument Injection vulnerability
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...
CVE-2025-32931
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...
CVE-2025-32931
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...
CVE-2025-32931
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...
PT-2025-16258 · Devdojo +1 · Devdojo Voyager +1
Name of the Vulnerable Software and Affected Versions: DevDojo Voyager versions 1.4.0 through 1.8.0 Description: The issue allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command when Laravel 8 or later is used. Recommendations: For DevDojo Voyager...
Voyager 安全漏洞
Voyager is an application by David Borland Personal Developer. A security vulnerability exists in Voyager versions 1.4.0 through 1.8.0 that originates from an authenticated administrator being able to execute arbitrary OS commands via specific php artisan commands...
CVE-2025-32931
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...
CVE-2025-32931
CVE-2025-32931 affects DevDojo Voyager versions 1.4.0–1.8.0. When Laravel 8+ is used, authenticated administrators can execute arbitrary OS commands via a specific php artisan command (linked to the Compass admin tooling). Technical details in connected sources point to a vulnerable command imple...
The vulnerability of the Voyager PHP-framework Laravel, related to the lack of protection for website structure, allows attackers to perform cross-site scripting (XSS) attacks.
The vulnerability of the Voyager PHP framework Laravel is related to the lack of security measures for website structure protection. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting XSS attacks remotely...
The vulnerability of the Voyager PHP framework Laravel, related to errors in handling relative pathnames to directories, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the Voyager PHP-framework Laravel relates to errors in handling relative pathnames to directories. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...
The vulnerability of the getMimeType function in the Voyager PHP framework Laravel allows a hacker to execute arbitrary code.
The vulnerability of the getMimeType function in the Voyager PHP framework Laravel relates to the unlimited loading of files of a dangerous type. Exploiting this vulnerability allows an attacker to execute arbitrary code, provided that the user opens a specially crafted file...
DevDojo Voyager vulnerable to reflected Cross-site Scripting
DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed...
GHSA-MM49-4F2G-C3WF DevDojo Voyager vulnerable to reflected Cross-site Scripting
DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed...