High WID-SEC-2025-0520 2 CVEs

Laravel Framework: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Mar 10, 2025 · Updated Mar 10, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Laravel Framework ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Laravel ist ein in PHP geschriebenes Framework für Webanwendungen.

Vulnerabilities 2

High 8.0

CVE-2024-13918

Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

Laravel Holdings Laravel Framework laravel/framework Packagist

Mar 10, 2025
High 8.0

CVE-2024-13919

Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.

Laravel Holdings Laravel Framework laravel/framework Packagist

Mar 10, 2025

Revision history

2025-03-10 #1
Initiale Fassung

References

GitHub Advisory Database vom 2025-03-10
https://github.com/advisories/GHSA-546h-56qp-8jmw
GitHub Advisory Database vom 2025-03-10
https://github.com/advisories/GHSA-83wp-f5c3-hqqr
OSS Security Mailing List vom 2025-03-10
https://seclists.org/oss-sec/2025/q1/195
OSS Security Mailing List vom 2025-03-10
https://seclists.org/oss-sec/2025/q1/196