Laravel

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-24941 1Laravel 1Laravel Jun 17, 2026 Sep 4, 2020 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.
CVE-2020-24940 1Laravel 1Laravel Jun 17, 2026 Sep 4, 2020 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.
CVE-2018-6330 1Laravel 1Framework Jun 17, 2026 Mar 28, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters.
CVE-2018-15133 1Laravel 1Laravel Nov 7, 2025 Aug 9, 2018 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illumi...Show more In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.Show less
CVE-2017-16894 1Laravel 1Laravel May 13, 2026 Nov 20, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeN...Show more In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.Show less
CVE-2017-14775 1Laravel 1Laravel May 13, 2026 Sep 28, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
CVE-2017-9303 1Laravel 1Laravel May 13, 2026 May 29, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.

Previous 12