Laravel Framework

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Laravel has a File Validation Bypass

OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.

Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters.

Laravel allows environment manipulation via query string

Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

Blade `@parent` Exploitation Leading To Possible XSS in Laravel

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.