EUVD-2026-68765

Livewire DOM-based cross-site scripting during client-side state handling...

CVE-2021-32708

CVE-2021-32708 Las versiones afectadas de este paquete son vulnerables a una condición de carrera. La normalización de espacios en blanco utilizada en las versiones 1.x y 2.x elimina cualquier espacio en blanco Unicode. Bajo ciertas condiciones específicas, esto podría permitir que un usuario...

Lab-for-cve-2018-15133

Resumen: Explotación de la vulnerabilidad de deserialización CVE-2018-15133 Este exploit aprovecha una vulnerabilidad de deserialización en Laravel Framework hasta 5.5.40 y 5.6.x hasta 5.6.29. Descripción La ejecución remota de código podría ocurrir como resultado de una llamada a unserialize sob...

exploit_laravel_cve-2018-15133

Laravel exploit for CVE-2018-15133 This code exploit CVE-2018-15133 and it is based on kosmiz's PoC and Metasploit's exploit for this vulnerability. I pretty much just did this for a box in Hack The Box, because I did not want to use Metasploit at the moment and as a excuse for practicing Python...

Larascript

root@kitploit: | | | | | | / || '| / |/ | / || '|| || ' \ | | | | | | || | | | |\ | | | | || | || | || ,||| ,||/ ||| ||| ./ | || Authors: @pwnedshell & @rsgbengi 📌 What its Larascript? Larascript is a script which take advantage from CVE-2018-15133 and can execute remote commands if a...

CVE-2018-15133-laravel-framework

CVE-2018-15133 - Laravel Framework 5.6.x 漏洞实验环境 此仓库提供了一个可重现的 Docker 实验环境，用于 CVE-2018-15133 （当 APPKEY 已知时，Laravel 框架令牌反序列化导致远程代码执行）。 该应用固定在有漏洞的 Laravel 5.6.x 版本上，并在 web 中间件组下暴露了一个简单的 /poc POST 路由，从而触发 CSRF 令牌解析。 快速启动 root@kitploit: docker compose up -d --build 打开： http://localhost:18088/ 已知的 APPKE...

OctoberCMS - Account Takeover

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...

EXPLOIT-CVE-2025-27515

CVE-2025-27515 Proof of Concept Eine praktische Demonstration von CVE-2025-27515 , einer Schwachstelle zur Umgehung der Datei-Upload-Validierung im Laravel-Framework ≤ 12.0.0. Überblick über die Schwachstelle CVE-2025-27515 ist eine Validierungsumgehung, die es Angreifern ermöglicht,...

laravel-framework

Über Laravel Hinweis: Dieses Repository enthält den Kerncode des Laravel-Frameworks. Wenn Sie eine Anwendung mit Laravel erstellen möchten, besuchen Sie das Haupt-Laravel-Repository. Laravel ist ein Webanwendungs-Framework mit ausdrucksstarker, eleganter Syntax. Wir glauben, dass Entwicklung ein...

CVE-2026-35445 Winter: Authenticated backend users can bypass Users controller permission checks

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...

CLSA-2026-1784077493 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 7.30.7-p2+tuxcare...

CLSA-2026-1783558967 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 9.52.21-p2+tuxcare...

CLSA-2025-1761785347 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.83.29-p1+tuxcare...

CLSA-2025-1761785337 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.44.0-p1+tuxcare...

CLSA-2026-1779842936 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.48.28-p1+tuxcare...

The vulnerability of the dedoc/scramble package for the Laravel PHP framework allows a hacker to execute arbitrary code.

The vulnerability of the dedoc/scramble package for the Laravel PHP framework is related to incorrect code generation practices. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-66416 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

EUVD-2026-38392

Filament: Multi-factor authentication app recovery codes can still be used multiple times via concurrent submission...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization due to insufficient permission checks in the store method of the UsersController. An attacker can assign full administrative privileges to a newly...