CVE-2021-43808mediumCWE-79

CVE-2021-43808: medium-severity vulnerability in laravel framework

Blade `@parent` Exploitation Leading To Possible XSS in Laravel

Published · Updated

Follow this CVE+ Monitor framework+ Monitor laravel/framework

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.8%
Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
laravel · framework
Related CVEs — laravel framework

In the same product, most dangerous first.

CVE-2024-52301HIGHLaravel allows environment manipulation via query stringEPSS 44.8%CVE-2026-114509CRITICALLaravel TokenGuard authentication bypass through non-string API credentialsEPSS 1.8%CVE-2021-21263HIGHQuery Binding Exploitation in LaravelEPSS 1.6%CVE-2025-27515MEDIUMLaravel has a File Validation BypassEPSS 0.7%CVE-2026-48019HIGHCRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relayEPSS 0.5%CVE-2026-114508MEDIUMLaravel relationship inclusion can trigger unauthorized data destructionEPSS 0.4%