Arbitrary File Upload

encore/laravel-admin is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate files uploaded, allowing an attacker to bypass the file upload restrictions by uploading a malicious .php file...

Cross-Site Scripting (XSS)

encore/laravel-admin is vulnerable to cross-site scripting XSS. It is possible because it does not properly handle the "Operation Log" screen, allowing an attacker to inject arbitrary script through Slug or Name parameters on the Roles screen...