Malicious password-reset in Akaunting

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please...

CVE-2021-32648

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5...

CVE-2021-36804

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please...

CVE-2021-36804 Akaunting Password Reset Relay

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please...

LavaLite Cross-Site Scripting Vulnerability (CNVD-2021-50080)

Lavalite is an open source content management system developed using the Laravel framework. A cross-site scripting vulnerability exists in LavaLite version 5.8.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the "menu link" feature...

LavaLite Cross-Site Scripting Vulnerability (CNVD-2021-48514)

Lavalite is an open source content management system developed using the Laravel framework. A stored cross-site scripting vulnerability exists in the /admin/user/team component of LavaLite version 5.8.0, which can be exploited by an attacker to execute arbitrary Web script or HTML via the ""New""...

LavaLite Cross-Site Scripting Vulnerability (CNVD-2021-48515)

Lavalite is an open source content management system developed using the Laravel framework. A stored cross-site scripting vulnerability exists in the /admin/roles/role component of LavaLite version 5.8.0, which can be exploited by an attacker to execute arbitrary Web script or HTML via the ""New"...

Laravel Framework Remote Code Execution (CVE-2018-15133)

A command injection vulnerability exists in Laravel Framework. This is due to insufficient handling of X-XSRF-TOKEN header in phpgcc library. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Exploit for CVE-2019-9081

PoC exploit for CVE-2019-9081, a vulnerability in the Laravel fr...

LavaLite Cross-Site Scripting Vulnerability (CNVD-2021-29738)

Lavalite is an open source content management system developed using the Laravel framework. A cross-site scripting vulnerability exists in LavaLite version 5.8.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the "address" field...

Laravel Framework SQL Injection Vulnerability

Laravel Framework is a PHP-based web application development framework by Taylor Otwell, an individual developer. Laravel Framework suffers from a SQL injection vulnerability that stems from a query binding exploit that causes the query builder to not return any results. The following products an...

XSS Vulnerability in Tipask Community Edition of Wuhan MicroQuestion Network Technology Co.

Tipask is an open source PHP Q&A system, based on Laravel 5.6 version development, easy to expand, with strong load capacity and stability. Wuhan Microsoft Network Technology Co., Ltd Tipask there are XSS vulnerabilities, attackers can use the vulnerability to obtain user cookies and other...

Online Trade - Online trading and cryptocurrency investment system security breach

Online Trade - Online trading and cryptocurrency investment system is a set of online foreign exchange and currency trading system developed using the Laravel framework. A security vulnerability exists in Online Trade - Online trading and cryptocurrency investment system. A remote attacker can...

Arbitrary File Deletion Vulnerability in PopojiCMS

POPOJI is built on the Laravel framework and can be used to create your own classic engine. PopojiCMS has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files...

omegainc.com.br Improper Access Control vulnerability

Security Researcher osvaldohp Helped patch 1 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting omegainc.com.br website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug...

XSS Vulnerability in KPPW Wizards System

KPPW-v3.3 crowdsourcing wiki system developed by Wuhan Kiker Information Technology Co., Ltd. is a set of large-scale platform system based on the laravel framework developed for project transactions, settlement. There is an XSS vulnerability in the KPPW system, which can be exploited to obtain...

Remote Code Execution (RCE)

laravel/framework is vulnerable to remote code execution RCE. It can occur because there is an unserialized call on the potentially untrusted X-XSRF-TOKEN value. The attacker can execute arbitrary code when decrypting certain files if they have access to the application key...

Laravel framework remote code execution vulnerability

Laravel framework is a set of simple , elegant PHP Web development framework. A remote code execution vulnerability exists in Laravel framework versions 5.5.40 and earlier and versions 5.6.x through 5.6.29. The vulnerability stems from an unserialized call to an untrusted X-XSRF-TOKEN value. An...

Remote code execution

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in...

CVE-2018-15133

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in...