livewire-honeypot

Livewire Honeypot Un honeypot de alta interacción que se hace pasar por una aplicación vulnerable de Laravel/Livewire. Captura intentos de explotación dirigidos a CVEs conocidos de Livewire, almacena archivos maliciosos subidos webshells y cargas útiles de ejecución remota de código RCE con...

Project-CVE-2025-54068

Livewire2025CVE Escáner de CVE-2025-54068 para Livewire Escáner automatizado de vulnerabilidades para detectar CVE-2025-54068 en aplicaciones Laravel que utilizan Livewire v3.0.0-beta.1 hasta v3.6.3. Descripción general Esta herramienta analiza una lista de sitios web en busca de indicadores de l...

POC-CVE-2026-65971

CVE-2026-65971 — Inyección SQL en Livewire PowerGrid mediante sortDirection Prueba de concepto e informe técnico completo para CVE-2026-65971 / GHSA-7fgc-3h6c-698r , una inyección SQL en power-components/livewire-powergrid accesible a través de la propiedad pública sortDirection de Livewire. |...

livewire-vuln-scanner

Escáner Pasivo de Vulnerabilidades Livewire El Escáner Pasivo de Vulnerabilidades Livewire es una herramienta Python 2.7 diseñada para detectar pasivamente las versiones de Livewire utilizadas por los sitios web e identificar posibles vulnerabilidades basándose en la comparación de versiones. Est...

Laravel Livewire v3 - Remote Command Execution

Livewire v3 Laravel contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution RCE without authentication under certain conditions. id: CVE-2025-54068 info: name: Laravel Livewire v3 - Remote Command Execution author: flame-11...

CVE-2025-54068-livewire

CVE-2025-54068 - Laboratorio vulnerable de Livewire v3.6.3 Esta carpeta construye una aplicación mínima de Laravel + Livewire v3 fijada en Livewire 3.6.3 vulnerable para reproducir CVE-2025-54068. El componente montado está escrito intencionalmente para ser compatible con la cadena de explotación...

recon-test-livewire

关于 Laravel Laravel 是一个具有表达力强、语法优雅的 Web 应用程序框架。我们相信，开发必须是一种愉快且富有创造性的体验，才能真正令人满足。Laravel 通过简化许多 Web 项目中的常见任务来消除开发中的痛苦，例如： 简单、快速的路由引擎。 强大的依赖注入容器。 会话和缓存存储的多种后端。 表达力强、直观的数据库 ORM。 与数据库无关的模式迁移。 稳健的后台任务处理。 实时事件广播。 Laravel 易于使用、功能强大，并提供了构建大型、稳健应用所需的各种工具。 学习 Laravel Laravel 拥有所有现代 Web...

Livepyre

Livepyre Una herramienta diseñada para explotar CVE-2025-54068 y la ejecución remota de comandos si se conoce la APPKEY del proyecto Livewire. Autores de la herramienta: @remsio @Worty. Ayuda $ ./Livepyre.py -h usage: Livepyre.py -h -u URL -f FUNCTION -p PARAM -H HEADERS -P PROXY -a APPKEY -d -F ...

CVE-2025-54068

CVE-2025-54068 一个设计用于利用 CVE-2025-54068 并在已知 Livewire 项目的 APPKEY 时实现远程命令执行的工具。 此工具是 Synacktiv 原始项目的重新编码版本： Livepyre — https://github.com/synacktiv/Livepyre 核心概念和方法基于原始实现。 此版本包含微小增强和附加功能，以提高可用性和灵活性。 安装 使用 pipx 安装该工具： pipx install git+https://github.com/haxorstars/CVE-2025-54068 或使用 uv： uv tool...

CLSA-2026-1790868699 TuxCare security update for livewire/livewire (1 CVE)

TuxCare rebuilt livewire/livewire to address 1 CVE. Fixed in v3.6.4-p1+tuxcare...

CLSA-2026-1790868445 TuxCare security update for livewire/livewire (1 CVE)

TuxCare rebuilt livewire/livewire to address 1 CVE. Fixed in 3.6.3-p2+tuxcare...

Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

Summary The service downgrade implementation in app/Livewire/Services/Upgrade.php::doUpgrade executes a proration calculation and a subsequent user credit refund without any transactional safety or database locks. The only concurrency check relies on an unisolated database query checking for...

CVE-2026-71537

Paymenter , an open-source webshop solution for hosting services, is affected by a credit-refund double-spend race condition in the service downgrade flow. In app/Livewire/Services/Upgrade.php::doUpgrade(), the method checks Service::upgradable and later executes $credit->increment('amount', a...

EUVD-2026-81030

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92762

Pelican Panel versions before 1.0.0-beta35 contain an authorization bypass in the Startup page component. Write permissions are enforced only through disabled form controls (client-side) rather than server-side checks, meaning an attacker with the low-level startup.read permission can craft Livew...

CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92762: Missing Authorization

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

PT-2026-94044

Name of the Vulnerable Software and Affected Versions Pelican Panel versions prior to 1.0.0-beta35 Description Startup write permissions are enforced only through disabled form controls instead of server-side authorization checks. An attacker with startup.read permission can craft Livewire state...

CVE-2026-56830

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56825

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make'delete' and DeleteBulkAction::make without deletecollections authorization, while public Collection $collection remains client mutable becaus...