LA
Product
Laravel
On CISA KEVExploited in the wild
10
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 5Medium 3Low 0
Watch
Add Laravel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-15133 In wildKEV | 8.1 | Aug 9 | In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value Affected: through 5.5.40; 5.6.0 through 5.6.29 |
| CVE-2021-28254 | 9.8 | Apr 19 | A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands Affected: 8.5.9 |
| CVE-2022-2870 | 9.8 | Aug 17 | A vulnerability was found in laravel 5.1 and classified as problematic Affected: 5.1.0 through 5.1.46 |
| CVE-2022-2886 | 8.8 | Aug 19 | A vulnerability, which was classified as critical, was found in Laravel 5.1 Affected: 5.1.0 through 5.1.46 |
| CVE-2020-24941 | 7.5 | Sep 4 | An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0 Affected: before 6.18.35; 7.0.0 before 7.24.0 |
| CVE-2020-24940 | 7.5 | Sep 4 | An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2 Affected: before 6.18.34; 7.0.0 before 7.23.2 |
| CVE-2017-16894 | 7.5 | Nov 20 | In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI Affected: through 5.5.21 |
| CVE-2017-9303 | 6.1 | May 29 | Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by… Affected: 5.4.0 |
| CVE-2017-14775 | 5.9 | Sep 28 | Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison Affected: through 5.5.9 |
| CVE-2021-21263 | 5.3 | Jan 19 | Laravel is a web application framework Affected: 6.0.0 before 6.20.11; 7.0.0 before 7.30.2; 8.0.0 before 8.22.1 |
Showing 10