Vulnerability GHSA-546h-56qp-8jmw
Medium Risk
MEDIUM RISK
CVSS Score: 4.7
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 year ago
March 10, 2025 at 12:30 PM UTC
Laravel framework susceptible to reflected cross-site scripting
11.9.0 - 11.35.1
11.9.0 - 11.35.1
Summary
Laravel framework susceptible to reflected cross-site scripting
Details
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
18 days ago
Laravel TokenGuard authentication bypass through non-string API credentials
4.0.0-BETA2 - 10.50.3 and 11.0.0 - 11.56.0 and 12.0.0 - 12.67.0 and 13.0.0 - 13.26.1 GHSA-f9x3-7vq9-cph6
4.0.0-BETA2 - 10.50.3 and 11.0.0 - 11.56.0 and 12.0.0 - 12.67.0 and 13.0.0 - 13.26.1 GHSA-f9x3-7vq9-cph6
Medium Risk
18 days ago
Laravel relationship inclusion can trigger unauthorized data destruction
12.45.0 - 12.67.0 and 13.0.0 - 13.26.1 GHSA-5wcm-3v2w-8362
12.45.0 - 12.67.0 and 13.0.0 - 13.26.1 GHSA-5wcm-3v2w-8362
Low Risk
1 month ago
Laravel: XSS in Debug Page Information
4.0.0-BETA2 - 12.68.0 and 13.0.0 - 13.29.0 GHSA-jh5r-qr3c-85q8
4.0.0-BETA2 - 12.68.0 and 13.0.0 - 13.29.0 GHSA-jh5r-qr3c-85q8
Medium Risk
4 months ago
Laravel Framework: Temporary Signed URL Path Confusion
4.0.0-BETA2 - 12.61.0 and 13.0.0 - 13.11.2 GHSA-crmm-hgp2-wgrp
4.0.0-BETA2 - 12.61.0 and 13.0.0 - 13.11.2 GHSA-crmm-hgp2-wgrp
High Risk
4 months ago
Laravel Framework: CRLF injection in default email rule
4.0.0-BETA2 - 12.59.0 and 13.0.0 - 13.9.0 GHSA-5vg9-5847-vvmq
4.0.0-BETA2 - 12.59.0 and 13.0.0 - 13.9.0 GHSA-5vg9-5847-vvmq
Impacted packages
Timeline
Published
1 year ago
March 10, 2025 at 12:30 PM UTC
Fixed (11.36.0)
1 year ago
December 17, 2024 at 06:21 PM UTC
Last Modified
1 year ago
March 11, 2025 at 02:52 PM UTC