laravel/framework
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Packagist
- Vulnerability status
- 28 advisory(ies) without a verdict
Advisories (28)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-3p32-j457-pg5x Query Binding Exploitation | 8.0.0 – < 8.22.1 ; 6.0.0 – < 6.20.11 ; 7.0.0 – < 7.30.2 | Undetermined |
| GHSA-44pg-c29v-hp6r Laravel Guard bypass in Eloquent models | 5.5.0 – 5.5.49 ; 6.0.0 – < 6.18.34 ; 7.0.0 – < 7.23.2 | Undetermined |
| GHSA-4mg9-vhxq-vm7j SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database | 8.0.0 – < 8.40.0 ; < 6.20.26 | Undetermined |
| GHSA-546h-56qp-8jmw Laravel framework susceptible to reflected cross-site scripting | 11.9.0 – < 11.36.0 | Undetermined |
| GHSA-5vg9-5847-vvmq Laravel Framework: CRLF injection in default email rule | 13.0.0 – < 13.10.0 ; < 12.60.0 | Undetermined |
| GHSA-5wcm-3v2w-8362 Laravel relationship inclusion can trigger unauthorized data destruction | 12.45.0 – < 12.68.0 ; 13.0.0 – < 13.27.0 | Undetermined |
| GHSA-66hf-2p6w-jqfw Laravel Framework XSS in Blade templating engine | < 6.20.42 ; 7.0.0 – < 7.30.6 ; 8.0.0 – < 8.75.0 | Undetermined |
| GHSA-6jvx-8ch9-j2jr Laravel Cookie serialization vulnerability | 5.5.0 – < 5.6.30 | Undetermined |
| GHSA-7852-w36x-6mf6 Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior | < 5.5.40 ; 5.6.0 – < 5.6.15 | Undetermined |
| GHSA-78fx-h6xr-vch4 Laravel has a File Validation Bypass | 12.0.0 – < 12.1.1 ; 11.0.0 – < 11.44.1 ; < 10.48.29 | Undetermined |
| GHSA-83wp-f5c3-hqqr Laravel framework susceptible to reflected cross-site scripting | 11.9.0 – < 11.36.0 | Undetermined |
| GHSA-c2v7-j5gq-wcq4 Laravel Sensitive Data Exposure | < 5.5.10 | Undetermined |
| GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion | 13.0.0 – < 13.12.0 ; < 12.61.1 | Undetermined |
| GHSA-f9x3-7vq9-cph6 Laravel TokenGuard authentication bypass through non-string API credentials | 13.0.0 – < 13.29.0 ; < 12.68.0 | Undetermined |
| GHSA-gv7v-rgg6-548h Laravel environment manipulation via query string | < 6.20.45 ; 7.0.0 – < 7.30.7 ; 8.0.0 – < 8.83.28 ; … | Undetermined |
| GHSA-jh5r-qr3c-85q8 Laravel: XSS in Debug Page Information | < 12.69.0 ; 13.0.0 – < 13.30.0 | Undetermined |
| GHSA-jwvj-pwww-3mj5 laravel framework Unexpected database bindings via requests | 6.0.0 – < 6.20.14 ; 7.0.0 – < 7.30.4 ; 8.0.0 – < 8.24.0 | Undetermined |
| GHSA-p62r-7637-3wwc Laravel Hijacked authentication cookies vulnerability | 4.0.0 – < 4.1.26 | Undetermined |
| GHSA-pfg4-p438-p874 Laravel Framework Deserialization Vulnerability | 5.7.0 – < 6.20.44 | Undetermined |
| GHSA-qm5c-m76r-2hfr Laravel RCE vulnerability in "cookie" session driver | 4.1.0 – < 6.18.31 ; 7.0.0 – < 7.22.4 | Undetermined |
| GHSA-qvqm-h22r-4cp9 Laravel Framework RCE Vulnerability | ≤ 5.5.40 ; 5.6.0 – < 5.6.30 | Undetermined |
| GHSA-rc8x-jrrc-frfv Laravel does not properly constrain the host portion of a password-reset URL | 5.3.0 – 5.3.31 ; 5.4.0 – < 5.4.22 | Undetermined |
| GHSA-rj3w-99gc-8j58 Laravel Risk of mass-assignment vulnerabilities | 4.0.0 – < 4.1.29 | Undetermined |
| GHSA-vr95-p7q6-8m9q Laravel Cross-site Scripting (XSS) vulnerability in blade templating | 7.0.0 – < 7.1.2 | Undetermined |
| GHSA-w2pm-r78h-4m7v OS Command Injection in Laravel Framework | < 5.8.17 | Undetermined |
| GHSA-w68r-5p45-5rqp Improper Input Validation in Laravel | < 6.18.35 ; 7.0.0 – < 7.24.0 | Undetermined |
| GHSA-wq8p-mqvg-2p5h laravel framework SQL Injection via limit and offset functions | 6.0.0 – < 6.20.26 ; 7.0.0 – < 7.30.5 ; 8.0.0 – < 8.40.0 | Undetermined |
| GHSA-x7p5-p2c9-phvg Unexpected database bindings | < 6.20.14 ; 7.0.0 – < 7.30.4 ; 8.0.0 – < 8.24.0 | Undetermined |
Withdrawn advisories (1)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-364w-9g92-3grq Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content. · withdrawn
Sources
| Source | Licence |
|---|