https://vulnerability.circl.lu Vulnerabilities published under the CPE names of Laravel framework. http://www.rssboard.org/rss-specification python-feedgen en Tue, 15 Sep 2026 06:21:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-48019 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay https://vulnerability.circl.lu/vuln/cve-2026-48019 Fri, 04 Sep 2026 22:11:40 +0000 https://vulnerability.circl.lu/vuln/cve-2018-15133 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack. In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack. https://vulnerability.circl.lu/vuln/cve-2018-15133 Thu, 09 Aug 2018 19:00:00 +0000 https://vulnerability.circl.lu/vuln/cve-2022-2870 laravel deserialization laravel deserialization https://vulnerability.circl.lu/vuln/cve-2022-2870 Wed, 17 Aug 2022 18:45:14 +0000 https://vulnerability.circl.lu/vuln/cve-2022-2886 Laravel deserialization Laravel deserialization https://vulnerability.circl.lu/vuln/cve-2022-2886 Fri, 19 Aug 2022 12:00:17 +0000 https://vulnerability.circl.lu/vuln/cve-2024-13919 Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page https://vulnerability.circl.lu/vuln/cve-2024-13919 Mon, 10 Mar 2025 10:03:01 +0000 https://vulnerability.circl.lu/vuln/cve-2024-13918 Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page https://vulnerability.circl.lu/vuln/cve-2024-13918 Mon, 10 Mar 2025 10:02:29 +0000 https://vulnerability.circl.lu/vuln/cve-2025-27515 Laravel has a File Validation Bypass Laravel has a File Validation Bypass https://vulnerability.circl.lu/vuln/cve-2025-27515 Wed, 05 Mar 2025 18:45:50 +0000 https://vulnerability.circl.lu/vuln/cve-2021-28254 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands. A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands. https://vulnerability.circl.lu/vuln/cve-2021-28254 Tue, 18 Apr 2023 00:00:00 +0000 https://vulnerability.circl.lu/vuln/cve-2022-40482 The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist. The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist. https://vulnerability.circl.lu/vuln/cve-2022-40482 Tue, 25 Apr 2023 00:00:00 +0000 https://vulnerability.circl.lu/vuln/cve-2024-52301 Laravel allows environment manipulation via query string Laravel allows environment manipulation via query string https://vulnerability.circl.lu/vuln/cve-2024-52301 Tue, 12 Nov 2024 19:32:14 +0000