Laravel vulnerabilities

Latest Laravel CVEs

Newest publication first · page 1 of 14

1. CVE-2026-126061 Winter CMS: My Account preview exposes another backend user's profile by record ID

   Published 2026-11-10

   Medium·CVSS 4.3

   Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions array, and formFindMo...

2. CVE-2026-125341 Winter CMS: Stored XSS through Backend List widget image columns

   Published 2026-11-10

   Low·CVSS 2.0

   Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-p...

3. CVE-2026-125340 Winter CMS: Reflected XSS through the search query parameter in the backend Table widget

   Published 2026-11-10

   Medium·CVSS 4.5

   Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-cl...

4. CVE-2026-125339 Winter CMS: CSRF through AJAX handler names reachable as backend page actions

   Published 2026-11-10

   Medium·CVSS 6.1

   Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers wi...

5. CVE-2026-125338 Winter CMS: Stored XSS through cached Brand Settings and Editor Settings custom styles

   Published 2026-11-10

   Medium·CVSS 4.5

   Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The firs...

6. CVE-2026-125337 Winter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate

   Published 2026-11-10

   High·CVSS 8.3

   Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), o...

7. CVE-2026-124079 rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning

   Published 2026-11-09

   Critical·CVSS 9.3

   rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which r...

8. CVE-2026-63437 2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration

   Published 2026-11-06

   Medium·CVSS 6.5

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does...

9. CVE-2026-62855 FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files

   Published 2026-11-06

   Medium·CVSS 4.4

   FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APP_KEY can supply tr...

10. CVE-2026-118510 Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs

    Published 2026-10-28

    High·CVSS 7.7

    A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a re...

11. GHSA-mhf7-xp6r-6qrc Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

    Published 2026-10-23

    Medium·CVSS 6.5

    Impact Three issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for: Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters...

12. CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials

    Published 2026-10-21

    Critical·CVSS 9.2 EPSS 1.8%

    Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended exist...

13. CVE-2026-114508 Laravel relationship inclusion can trigger unauthorized data destruction

    Published 2026-10-21

    Medium·CVSS 6.5 EPSS 0.41%

    Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can e...

14. CVE-2026-55386 InvoiceShelf ORDER BY SQL injection through orderByField

    Published 2026-10-14

    High·CVSS 7.1

    InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyF...

15. CVE-2026-110630 VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment

    Published 2026-10-14

    High·CVSS 7.0

    VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles a...

16. CVE-2026-110629 VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions

    Published 2026-10-14

    High·CVSS 7.1

    VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or...

17. CVE-2026-109566 Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder

    Published 2026-10-12

    Critical·CVSS 9.3

    Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and s...

18. CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

    Published 2026-10-04

    Critical·CVSS 9.1

    The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps...

19. CVE-2026-104181 Filament: Multi-factor authentication (app) management actions do not require password reauthentication

    Published 2026-10-01

    Medium·CVSS 5.4 EPSS 0.35%

    Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authe...

20. CVE-2026-102628 Cadmos LTI exposure of sensitive information via debug mode

    Published 2026-10-01

    Critical·CVSS 9.2

    The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entir...

21. CVE-2026-102279 Laravel: XSS in Debug Page Information

    Published 2026-09-28

    Low·CVSS 3.1 EPSS 0.26%

    Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip...

22. CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

    Published 2026-09-27

    Medium·CVSS 6.9 EPSS 1.4%

    A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack ma...

23. CVE-2026-100884 Krayin laravel-crm attachment-download Endpoint acl.php resource injection

    Published 2026-09-27

    Medium·CVSS 5.3

    A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper contr...

24. CVE-2026-100883 Krayin laravel-crm acl.php access control

    Published 2026-09-27

    Medium·CVSS 5.3

    A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been publ...

25. CVE-2026-100882 Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting

    Published 2026-09-27

    Medium·CVSS 4.8

    A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.set...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.