Laravel Crm
Approved changes feed: RSS · Atom
cpe:2.3:a:venturedrake:laravel-crm:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Venturedrake (5f4a41bf-a6b1-5012-8419-15e2553be174) |
|---|---|
| Product | Laravel Crm (adc37c3b-b833-5507-87a1-3377c91e8ccb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-110630 |
vulnerable | 2026-11-03 10:16:01.587276 |
VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment
MEDIUM (6.5)
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
Published: 2026-10-14T14:17:04.557Z
Updated: 2026-10-14T20:20:11.778Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110629 |
vulnerable | 2026-11-03 10:16:01.033519 |
VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions
MEDIUM (6.5)
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Published: 2026-10-14T14:17:03.868Z
Updated: 2026-10-14T17:32:32.663Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.