Laravel Framework
10 CVEs affecting Laravel Framework. Latest disclosed: 2025-03-10. Critical: 2, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27515 | Critical | 9.8 | 2025-03-05 | Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request co… |
CVE-2021-43617 | Critical | 9.8 | 2021-11-14 | Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.ph… |
CVE-2020-19316 | High | 8.8 | 2021-12-20 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. |
CVE-2018-6330 | High | 8.8 | 2019-03-28 | Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters. |
CVE-2024-13919 | High | 8.0 | 2025-03-10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in… |
CVE-2024-13918 | High | 8.0 | 2025-03-10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters i… |
CVE-2024-52301 | High | 7.5 | 2024-11-12 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, th… |
CVE-2021-21263 | High | 7.2 | 2021-01-19 | Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies t… |
CVE-2022-40482 | Medium | 5.3 | 2023-04-25 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2… |
CVE-2021-43808 | Medium | 5.3 | 2021-12-08 | Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in th… |