CVE-2026-102279lowCWE-80

CVE-2026-102279: falha de baixa gravidade em laravel framework

Laravel: XSS in Debug Page Information

Publicada em · Atualizada em

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.1epss 0.2%
probabilidade de exploração
0.2%top 91% das CVEs
exploração observada
nãonenhuma fonte reporta
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Produtos afetados
laravel · framework
CVEs relacionadas — laravel framework

No mesmo produto, das mais perigosas para as menos.

CVE-2024-52301HIGHLaravel allows environment manipulation via query stringEPSS 44.8%CVE-2021-21263HIGHQuery Binding Exploitation in LaravelEPSS 1.6%CVE-2021-43808MEDIUMBlade `@parent` Exploitation Leading To Possible XSS in LaravelEPSS 0.8%CVE-2025-27515MEDIUMLaravel has a File Validation BypassEPSS 0.7%CVE-2026-48019HIGHCRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relayEPSS 0.5%
Referências
https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12https://github.com/laravel/framework/pull/61381https://github.com/laravel/framework/releases/tag/v12.69.0https://github.com/laravel/framework/releases/tag/v13.30.0https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8