https://vulnerability.circl.lu/product/989fde67-58b8-4480-9edf-d5c7eeb02edc/recent 2026-09-15T06:21:01.624517+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Vulnerabilities published under the CPE names of Laravel framework. https://vulnerability.circl.lu/vuln/cve-2026-48019 2026-09-08T13:01:38.157000+00:00 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

2026-09-04T22:11:40.811000+00:00 https://vulnerability.circl.lu/vuln/cve-2018-15133 2025-10-21T23:45:49.105000+00:00 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

2018-08-09T19:00:00+00:00 https://vulnerability.circl.lu/vuln/cve-2022-2870 2025-04-15T13:49:24.534000+00:00 laravel deserialization

laravel deserialization

2022-08-17T18:45:14+00:00 https://vulnerability.circl.lu/vuln/cve-2022-2886 2025-04-15T13:48:57.899000+00:00 Laravel deserialization

Laravel deserialization

2022-08-19T12:00:17+00:00 https://vulnerability.circl.lu/vuln/cve-2024-13919 2025-03-10T17:02:42.335000+00:00 Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

2025-03-10T10:03:01.374000+00:00 https://vulnerability.circl.lu/vuln/cve-2024-13918 2025-03-10T17:02:40.794000+00:00 Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

2025-03-10T10:02:29.530000+00:00 https://vulnerability.circl.lu/vuln/cve-2025-27515 2025-03-05T18:59:49.627000+00:00 Laravel has a File Validation Bypass

Laravel has a File Validation Bypass

2025-03-05T18:45:50.101000+00:00 https://vulnerability.circl.lu/vuln/cve-2021-28254 2025-03-05T18:53:58.816000+00:00 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.

A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.

2023-04-18T00:00:00+00:00 https://vulnerability.circl.lu/vuln/cve-2022-40482 2025-02-03T20:49:55.862000+00:00 The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.

2023-04-25T00:00:00+00:00 https://vulnerability.circl.lu/vuln/cve-2024-52301 2024-12-21T17:02:39.839000+00:00 Laravel allows environment manipulation via query string

Laravel allows environment manipulation via query string

2024-11-12T19:32:14.415000+00:00