exploit_laravel_cve-2018-15133

Exploit de Laravel para CVE-2018-15133 Este código explota CVE-2018-15133 y está basado en el PoC de kosmiz y el exploit de Metasploit para esta vulnerabilidad. Básicamente lo hice para una máquina en Hack The Box, porque no quería usar Metasploit en ese momento y como excusa para practicar Pytho...

CVE-2021-32708

CVE-2021-32708 Las versiones afectadas de este paquete son vulnerables a una condición de carrera. La normalización de espacios en blanco utilizada en las versiones 1.x y 2.x elimina cualquier espacio en blanco Unicode. Bajo ciertas condiciones específicas, esto podría permitir que un usuario...

CVE-2018-15133-laravel-framework

CVE-2018-15133 - Laboratorio Vulnerable de Laravel Framework 5.6.x Este repositorio proporciona un laboratorio Docker reproducible para CVE-2018-15133 RCE por deserialización de token en Laravel Framework cuando se conoce APPKEY. La aplicación está fijada a una versión vulnerable de Laravel 5.6.x...

OctoberCMS - Account Takeover

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...

EXPLOIT-CVE-2025-27515

CVE-2025-27515 Proof of Concept Eine praktische Demonstration von CVE-2025-27515 , einer Schwachstelle zur Umgehung der Datei-Upload-Validierung im Laravel-Framework ≤ 12.0.0. Überblick über die Schwachstelle CVE-2025-27515 ist eine Validierungsumgehung, die es Angreifern ermöglicht,...

Lab-for-cve-2018-15133

Riepilogo: MExploiting CVE-2018-15133 Vulnerabilità di deserializzazione Questo exploit sfrutta una vulnerabilità di deserializzazione nel framework Laravel fino alla versione 5.5.40 e nelle versioni 5.6.x fino alla 5.6.29. Descrizione L'esecuzione di codice remoto potrebbe verificarsi a seguito ...

Larascript

root@kitploit: | | | | | | / || '| / |/ | / || '|| || ' \ | | | | | | || | | | |\ | | | | || | || | || ,||| ,||/ ||| ||| ./ | || Autori: @pwnedshell & @rsgbengi 📌 Cos'è Larascript? Larascript è uno script che sfrutta CVE-2018-15133 e può eseguire comandi remoti se un'app Laravel vulnerabile è...

laravel-framework

Über Laravel Hinweis: Dieses Repository enthält den Kerncode des Laravel-Frameworks. Wenn Sie eine Anwendung mit Laravel erstellen möchten, besuchen Sie das Haupt-Laravel-Repository. Laravel ist ein Webanwendungs-Framework mit ausdrucksstarker, eleganter Syntax. Wir glauben, dass Entwicklung ein...

CVE-2026-35445 Winter: Authenticated backend users can bypass Users controller permission checks

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...

CLSA-2026-1784077493 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 7.30.7-p2+tuxcare...

CLSA-2026-1783558967 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 9.52.21-p2+tuxcare...

CLSA-2025-1761785347 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.83.29-p1+tuxcare...

CLSA-2025-1761785337 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.44.0-p1+tuxcare...

CLSA-2026-1779842936 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.48.28-p1+tuxcare...

The vulnerability of the dedoc/scramble package for the Laravel PHP framework allows a hacker to execute arbitrary code.

The vulnerability of the dedoc/scramble package for the Laravel PHP framework is related to incorrect code generation practices. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-66416 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

EUVD-2026-38392

Filament: Multi-factor authentication app recovery codes can still be used multiple times via concurrent submission...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization due to insufficient permission checks in the store method of the UsersController. An attacker can assign full administrative privileges to a newly...

GHSA-5VG9-5847-VVMQ Laravel Framework: CRLF injection in default email rule

Summary A CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied...