Cross-Site Scripting (XSS)

2021-12-0905:47:47

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

48.8%

JSON

laravel/framework is vulnerable to cross-site scripting (XSS). When the parent template contains an exploitable HTML structure, a remote attacker is able to inject arbitrary Javascript via guessing the parent placeholder SHA-1 hash by trying common names of sections.

CPENameOperatorVersion
laravel/frameworklev7.30.5
laravel/frameworklev8.74.0
laravel/frameworklev6.20.41
php-laravel-framework:bullseyeeq6.20.14+dfsg-1
laravel/frameworklev7.30.5
laravel/frameworklev8.74.0
laravel/frameworklev6.20.41
php-laravel-framework:bullseyeeq6.20.14+dfsg-1
php-laravel-framework:bookwormeq6.20.14+dfsg-2

Name	Operator	Version
laravel/framework	le	v7.30.5
laravel/framework	le	v8.74.0
laravel/framework	le	v6.20.41
php-laravel-framework:bullseye	eq	6.20.14+dfsg-1
laravel/framework	le	v7.30.5
laravel/framework	le	v8.74.0
laravel/framework	le	v6.20.41
php-laravel-framework:bullseye	eq	6.20.14+dfsg-1
php-laravel-framework:bookworm	eq	6.20.14+dfsg-2