CVE-2024-13918 | BDVDB-2026-269705 Detail
Laravel HoldingsLaravel Framework
Description#
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References#
- https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
- https://github.com/laravel/framework/pull/53869
- https://github.com/laravel/framework/releases/tag/v11.36.0
- http://www.openwall.com/lists/oss-security/2025/03/10/3
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.