Exposição de Laravel

Web frameworks
79
score de exposição
100.469
sites usam
0
em exploração
3
críticos
Análise Vexday

O histórico de vulnerabilidades do Laravel reúne 31 CVEs catalogadas, com duas classificadas como críticas e nenhuma presente no catálogo KEV da CISA, taxa que se mantém abaixo da média geral do catálogo. O volume recente merece atenção: 11 falhas surgiram nos últimos 90 dias, o que indica ritmo elevado de descoberta e exige acompanhamento contínuo de atualizações. O tipo de falha mais recorrente é CWE-434 (upload irrestrito de arquivos com tipo perigoso), categoria que, quando explorada, pode permitir execução remota de código e comprometer completamente aplicações. A CVE mais perigosa atualmente identificada é CVE-2021-23814, com EPSS de 0,0182, sugerindo probabilidade de exploração ainda baixa, mas não desprezível diante da natureza da falha dominante no perfil do framework.

CVEs

45 resultados
CVE-2024-7944MEDIUMitsourcecode Laravel Property Management System DocumentsController.php UpdateDocumentsRequest unrestricted uploadEPSS 0.5%CVE-2026-61460HIGHKrayin CRM Insecure Direct Object Reference via ControllersEPSS 0.5%CVE-2024-7945MEDIUMitsourcecode Laravel Property Management System Notes Page create cross site scriptingEPSS 0.5%CVE-2026-48557HIGHSpatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.phpEPSS 0.4%CVE-2026-49969MEDIUMLaravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL HandlingEPSS 0.4%CVE-2025-49130MEDIUMLaravel Translation Manager Vulnerable to Stored Cross-site ScriptingEPSS 0.4%CVE-2019-25673HIGHUniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File UploadEPSS 0.4%CVE-2026-49971MEDIUMLaravel-Mediable < 7.0.0 Stored XSS via SVG File UploadEPSS 0.4%CVE-2026-41453HIGHKrayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead ParameterEPSS 0.4%CVE-2025-58769LOWauth0-PHP: Improper File Type Handling in Bulk User ImportEPSS 0.4%CVE-2021-47763HIGHAimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injectionEPSS 0.3%CVE-2020-36950HIGHLaravel Nova 3.7.0 - 'range' DoSEPSS 0.3%CVE-2026-88022HIGHUnauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for LaravelEPSS 0.3%CVE-2026-7109MEDIUMcode-projects Invoice System in Laravel API Endpoint item improper authorizationEPSS 0.3%CVE-2026-48555MEDIUMSpatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()EPSS 0.2%CVE-2026-88028HIGHUnauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for LaravelEPSS 0.2%CVE-2026-88027HIGHMass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for LaravelEPSS 0.2%CVE-2021-47756HIGHLaravel Valet 2.0.3 - Local Privilege Escalation (macOS)EPSS 0.2%CVE-2026-5370MEDIUMkrayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scriptingEPSS 0.2%CVE-2026-7092MEDIUMcode-projects Invoice System in Laravel Profile profile improper authorizationEPSS 0.2%