Improper Authentication

Overview laravel/framework is a PHP framework for web artisans. Affected versions of this package are vulnerable to Improper Authentication via TokenGuard in src/Illuminate/Auth/TokenGuard.php, where the token retrieved from the request is not validated to be a string before being used for...

WS-2026-0147

laravel/framework v5.2.0-beta1 - v11.56.0, v12.0.0 - v12.67.0, v13.0.0 - v13.26.1 and illuminate/auth v5.2.0 - v11.51.0, v12.0.0 - v12.67.0, v13.0.0 - v13.27.0: TokenGuard passes non-string apitoken values arrays or JSON scalars to the user provider lookup, so on MySQL/MariaDB type juggling match...

laravel-crypto-killer

Laravel crypto killer Ein Werkzeug, das entwickelt wurde, um schlechte Implementierungen von Entschlüsselungsmechanismen in Laravel-Anwendungen auszunutzen. Dieses Werkzeug wurde ursprünglich entwickelt, um Payloads zu erstellen, die die Laravel-decrypt-Funktion aus dem Paket Illuminate\Encryptio...

CLSA-2026-1770598645 TuxCare security update for illuminate/view (1 CVE)

TuxCare rebuilt illuminate/view to address 1 CVE. Fixed in 5.4.36-p1+tuxcare...

CLSA-2026-1772239984 TuxCare security update for illuminate/database (1 CVE)

TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p1+tuxcare...

CLSA-2026-1772326385 TuxCare security update for illuminate/database (1 CVE)

TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p2+tuxcare...

PT-2026-73741

TuxCare rebuilt illuminate/view to address 1 CVE. Fixed in 5.4.36-p1+tuxcare...

PT-2026-73805

TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p2+tuxcare...

PT-2026-73803

TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p1+tuxcare...

EUVD-2021-0484

Malware in sbrugna...

CVE-2021-21263

Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an...

BIT-LARAVEL-2021-21263 Query Binding Exploitation in Laravel

Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an...

CVE-2023-29931

laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php...

CVE-2023-29931

laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php...

DEBIAN-CVE-2022-40482

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...

CVE-2022-40482

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...

CVE-2022-40482: Observable Discrepancy

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...

CVE-2022-40482

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...

[H-05] Not minting iPTs for lenders in several lend functions

Lines of code Vulnerability details Impact Using any of the lend function mentioned, will result in loss of funds to the lender - as the funds are transferred from them but no iPTs are sent back to them! Basically making lending via these external PTs unusable. Proof of Concept There is no mintin...

Illuminate PT redeeming allows for burning from other accounts

Lines of code Vulnerability details Illuminate PT burns shares from a user supplied address account instead of user's account. With such a discrepancy a malicious user can burn all other's user shares by having the necessary shares on her balance, while burning them from everyone else. Setting th...