Vendor
LaraDashboard
18 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
Medium 5.4
LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content
LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, H…
-
Medium 4.3
LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send…
-
Medium 5.4
LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url
LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links t…
-
Medium 6.5
LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{option_nam…
-
Medium 5.3
LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exha…
-
Medium 5.4CVE-2026-90931 Public exploit
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators o…
-
Medium 5.4
Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the…