Framework

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Published: 2025-03-05T18:45:50.101Z
Updated: 2025-03-05T18:59:49.627Z

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

Published: 2024-11-12T19:32:14.415Z
Updated: 2024-12-21T17:02:39.839Z

An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.

Published: 2024-04-16T00:00:00.000Z
Updated: 2024-08-02T01:10:55.153Z

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.

Published: 2025-03-10T10:03:01.374Z
Updated: 2025-03-10T17:02:42.335Z

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

Published: 2025-03-10T10:02:29.530Z
Updated: 2025-03-10T17:02:40.794Z