Skip to content
OpenAdvisories

Package · Packagist

laravel/framework

28 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.9
    CVE-2026-48019 Public exploit

    CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

    Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.7
    CVE-2024-52301 Public exploit EPSS 45%

    Laravel allows environment manipulation via query string

    Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerabi…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.1
    CVE-2018-15133 Exploited Public exploit EPSS 77%

    Laravel Framework RCE Vulnerability

    In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and Pendi…

    laravel/framework Packagist
    KEV Jan 16, 2024