CVE-2025-54068

CVE-2025-54068 一个设计用于利用 CVE-2025-54068 并在已知 Livewire 项目的 APPKEY 时实现远程命令执行的工具。 此工具是 Synacktiv 原始项目的重新编码版本： Livepyre — https://github.com/synacktiv/Livepyre 核心概念和方法基于原始实现。 此版本包含微小增强和附加功能，以提高可用性和灵活性。 安装 使用 pipx 安装该工具： root@kitploit: pipx install git+https://github.com/haxorstars/CVE-2025-54068 或使用 u...

livewire-honeypot

Livewire Honeypot Un honeypot de alta interacción que se hace pasar por una aplicación vulnerable de Laravel/Livewire. Captura intentos de explotación dirigidos a CVEs conocidos de Livewire, almacena archivos maliciosos subidos webshells y cargas útiles de ejecución remota de código RCE con...

Project-CVE-2025-54068

Livewire2025CVE Escáner de CVE-2025-54068 para Livewire Escáner automatizado de vulnerabilidades para detectar CVE-2025-54068 en aplicaciones Laravel que utilizan Livewire v3.0.0-beta.1 hasta v3.6.3. Descripción general Esta herramienta analiza una lista de sitios web en busca de indicadores de l...

CVE-2026-71537

Paymenter , an open-source webshop solution for hosting services, is affected by a credit-refund double-spend race condition in the service downgrade flow. In app/Livewire/Services/Upgrade.php::doUpgrade(), the method checks Service::upgradable and later executes $credit->increment('amount', a...

POC-CVE-2026-65971

CVE-2026-65971 — Inyección SQL en Livewire PowerGrid mediante sortDirection Prueba de concepto e informe técnico completo para CVE-2026-65971 / GHSA-7fgc-3h6c-698r , una inyección SQL en power-components/livewire-powergrid accesible a través de la propiedad pública sortDirection de Livewire...

Laravel Livewire v3 - Remote Command Execution

Livewire v3 Laravel contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution RCE without authentication under certain conditions. id: CVE-2025-54068 info: name: Laravel Livewire v3 - Remote Command Execution author: flame-11...

CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92762

Pelican Panel versions before 1.0.0-beta35 contain an authorization bypass in the Startup page component. Write permissions are enforced only through disabled form controls (client-side) rather than server-side checks, meaning an attacker with the low-level startup.read permission can craft Livew...

EUVD-2026-81030

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

livewire-vuln-scanner

Escáner Pasivo de Vulnerabilidades Livewire El Escáner Pasivo de Vulnerabilidades Livewire es una herramienta Python 2.7 diseñada para detectar pasivamente las versiones de Livewire utilizadas por los sitios web e identificar posibles vulnerabilidades basándose en la comparación de versiones. Est...

CVE-2025-54068-livewire

CVE-2025-54068 - Laboratorio vulnerable de Livewire v3.6.3 Esta carpeta construye una aplicación mínima de Laravel + Livewire v3 fijada en Livewire 3.6.3 vulnerable para reproducir CVE-2025-54068. El componente montado está escrito intencionalmente para ser compatible con la cadena de explotación...

CVE-2026-56830

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56829

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

CVE-2026-56825

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make'delete' and DeleteBulkAction::make without deletecollections authorization, while public Collection $collection remains client mutable becaus...

EUVD-2026-78920

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56830

Shopper (Headless e-commerce Admin Panel) is affected by a missing authorization check in the Media sub-form (packages/admin/src/Livewire/Components/Products/Form/Media.php). The store() method lacked the authorize('edit_products') call that was added to five sibling sub-forms (Edit, Inventory, S...

CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

EUVD-2026-78916

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...

CVE-2026-56827 Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...

EUVD-2026-78914

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...