OctoberCMS - Account Takeover

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...

laravel-framework

About Laravel Note: This repository contains the core code of the Laravel framework. If you want to build an application using Laravel, visit the main Laravel repository. Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable, creative...

Larascript

| | | | | | / || '| / |/ | / || '|| || ' \ | | | | | | || | | | |\ | | | | || | || | || ,||| ,||/ ||| ||| ./ | || Authors: @pwnedshell & @rsgbengi 📌 What its Larascript? Larascript is a script which take advantage from CVE-2018-15133 and can execute remote commands if a vulnerable Laravel app...

Lab-for-cve-2018-15133

Summary: MExploiting CVE-2018-15133 Deserialization Vulnerability This exploit takes advantage of a deserialization vulnerability in the Laravel Framework through 5.5.40 and 5.6.x through 5.6.29. Description Remote code execution might occur as a result of an unserialize call on a potentially...

CVE-2018-15133-laravel-framework

CVE-2018-15133 - Laravel Framework 5.6.x Vulnerable Lab This repo provides a reproducible Docker lab for CVE-2018-15133 Laravel Framework token unserialize RCE when APPKEY is known. The app is pinned to a vulnerable Laravel 5.6.x version and exposes a simple /poc POST route under the web middlewa...

CVE-2021-32708

CVE-2021-32708 Affected versions of this package are vulnerable to Race Condition. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. How the Exploit Works...

EXPLOIT-CVE-2025-27515

CVE-2025-27515 Proof of Concept A practical demonstration of CVE-2025-27515 , a file upload validation bypass vulnerability in Laravel Framework ≤ 12.0.0. Vulnerability Overview CVE-2025-27515 is a validation bypass that allows attackers to circumvent file upload restrictions when Laravel...

CLSA-2026-1793346652 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 12.58.0-p7+tuxcare...

CLSA-2026-1793275323 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.12.3-p6+tuxcare...

CLSA-2026-1793200604 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.50.2-p4+tuxcare...

CLSA-2026-1793193692 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.51.0-p4+tuxcare...

CLSA-2026-1793193622 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 9.52.21-p4+tuxcare...

CLSA-2026-1793190676 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 12.58.0-p6+tuxcare...

CLSA-2026-1793190457 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.83.29-p6+tuxcare...

CLSA-2026-1793190394 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.48.29-p2+tuxcare...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions before 12.68.0 and versions 13.0.0 through 13.28.0 contain a TokenGuard authentication bypass when token-based API guards use un-hashed tokens with MySQL or MariaDB. The proof of concept demonstrates authentication as an unintended user using a non-string credential...

CVE-2026-114509

CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials 🔴 CVE-2026-114509 — Laravel TokenGuard Authentication Bypass Unauthenticated Authentication Bypass in Laravel Framework — TokenGuard API Guard 📋 Overview CVE-2026-114509 is a critical authentication bypass...

CLSA-2026-1793092408 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.44.0-p4+tuxcare...

Exploit for CVE-2026-114509

CVE-2026-114509 Laravel TokenGuard authentication bypass thro...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions prior to 12.68.0 and 13.29.0 contain an authentication bypass in TokenGuard when non-string API credentials are processed with MySQL or MariaDB. The supplied proof of concept scans for affected targets and attempts authentication bypasses...