.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

laravel/framework 13.12.0 vulnerabilities

28 advisories known · laravel/framework@13.12.0 · 3 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 13.12.0

SEVERITYADVISORYPUBLISHED

CriticalLaravel TokenGuard authentication bypass through non-string API credentialsGHSA-f9x3-7vq9-cph6CVE-2026-114509Affected <12.68.0, >=13.0.0 <13.29.0Fixed in 12.68.0 Fixed in 13.29.0OSV source ↗17 days ago

MediumLaravel relationship inclusion can trigger unauthorized data destructionGHSA-5wcm-3v2w-8362CVE-2026-114508Affected >=12.45.0 <12.68.0, >=13.0.0 <13.27.0Fixed in 12.68.0 Fixed in 13.27.0OSV source ↗17 days ago

LowLaravel: XSS in Debug Page InformationGHSA-jh5r-qr3c-85q8CVE-2026-102279Affected <12.69.0, >=13.0.0 <13.30.0Fixed in 12.69.0 Fixed in 13.30.0OSV source ↗last month

Does not affect 13.12.0

SEVERITYADVISORYPUBLISHED

CriticalLaravel RCE vulnerability in "cookie" session driverGHSA-qm5c-m76r-2hfrAffected >=4.1.0 <6.18.31, >=7.0.0 <7.22.4Fixed in 6.18.31 Fixed in 7.22.4OSV source ↗2 years ago

CriticalLaravel Framework Deserialization VulnerabilityGHSA-pfg4-p438-p874CVE-2019-9081Affected >=5.7.0 <6.20.44Fixed in 6.20.44OSV source ↗4 years ago

HighLaravel Framework: CRLF injection in default email rule GHSA-5vg9-5847-vvmqCVE-2026-48019Affected <12.60.0, >=13.0.0 <13.10.0Fixed in 12.60.0 Fixed in 13.10.0OSV source ↗5 months ago

HighOS Command Injection in Laravel FrameworkGHSA-w2pm-r78h-4m7vCVE-2020-19316Affected <5.8.17Fixed in 5.8.17OSV source ↗5 years ago

HighLaravel Framework RCE VulnerabilityGHSA-qvqm-h22r-4cp9CVE-2018-15133Affected <=5.5.40, >=5.6.0 <5.6.30Fixed in 5.6.30OSV source ↗4 years ago

Highlaravel framework SQL Injection via limit and offset functionsGHSA-wq8p-mqvg-2p5hAffected >=6.0.0 <6.20.26, >=7.0.0 <7.30.5, >=8.0.0 <8.40.0Fixed in 6.20.26 Fixed in 7.30.5 Fixed in 8.40.0OSV source ↗2 years ago

Highlaravel framework Unexpected database bindings via requestsGHSA-jwvj-pwww-3mj5Affected >=6.0.0 <6.20.14, >=7.0.0 <7.30.4, >=8.0.0 <8.24.0Fixed in 6.20.14 Fixed in 7.30.4 Fixed in 8.24.0OSV source ↗2 years ago

HighLaravel Cookie serialization vulnerabilityGHSA-6jvx-8ch9-j2jrAffected >=5.5.0 <5.6.30Fixed in 5.6.30OSV source ↗2 years ago

HighSQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/databaseGHSA-4mg9-vhxq-vm7jAffected <6.20.26, >=8.0.0 <8.40.0Fixed in 6.20.26 Fixed in 8.40.0OSV source ↗6 years ago

HighImproper Input Validation in LaravelGHSA-w68r-5p45-5rqpBIT-laravel-2020-24941CVE-2020-24941Affected <6.18.35, >=7.0.0 <7.24.0Fixed in 6.18.35 Fixed in 7.24.0OSV source ↗6 years ago

HighUnexpected database bindingsGHSA-x7p5-p2c9-phvgAffected <6.20.14, >=7.0.0 <7.30.4, >=8.0.0 <8.24.0Fixed in 6.20.14 Fixed in 7.30.4 Fixed in 8.24.0OSV source ↗6 years ago

HighQuery Binding ExploitationGHSA-3p32-j457-pg5xBIT-laravel-2021-21263CVE-2021-21263Affected >=6.0.0 <6.20.11, >=7.0.0 <7.30.2, >=8.0.0 <8.22.1Fixed in 6.20.11 Fixed in 7.30.2 Fixed in 8.22.1OSV source ↗6 years ago

MediumLaravel does not properly constrain the host portion of a password-reset URLGHSA-rc8x-jrrc-frfvCVE-2017-9303Affected >=5.3.0 <=5.3.31, >=5.4.0 <5.4.22Fixed in 5.4.22OSV source ↗4 years ago

MediumLaravel Framework XSS in Blade templating engineGHSA-66hf-2p6w-jqfwCVE-2021-43808Affected <6.20.42, >=7.0.0 <7.30.6, >=8.0.0 <8.75.0Fixed in 6.20.42 Fixed in 7.30.6 Fixed in 8.75.0OSV source ↗5 years ago

MediumLaravel has a File Validation BypassGHSA-78fx-h6xr-vch4BIT-laravel-2025-27515CVE-2025-27515Affected <10.48.29, >=11.0.0 <11.44.1, >=12.0.0 <12.1.1Fixed in 10.48.29 Fixed in 11.44.1 Fixed in 12.1.1OSV source ↗2 years ago

MediumLaravel Guard bypass in Eloquent modelsGHSA-44pg-c29v-hp6rAffected >=5.5.0 <=5.5.49, >=6.0.0 <6.18.34, >=7.0.0 <7.23.2Fixed in 6.18.34 Fixed in 7.23.2OSV source ↗2 years ago

MediumLaravel Encrypter Component Potential Decryption Failure Leading to Unintended BehaviorGHSA-7852-w36x-6mf6Affected <5.5.40, >=5.6.0 <5.6.15Fixed in 5.5.40 Fixed in 5.6.15OSV source ↗2 years ago

MediumLaravel Hijacked authentication cookies vulnerabilityGHSA-p62r-7637-3wwcAffected >=4.0.0 <4.1.26Fixed in 4.1.26OSV source ↗2 years ago

MediumLaravel Risk of mass-assignment vulnerabilitiesGHSA-rj3w-99gc-8j58Affected >=4.0.0 <4.1.29Fixed in 4.1.29OSV source ↗2 years ago

MediumLaravel Sensitive Data ExposureGHSA-c2v7-j5gq-wcq4CVE-2017-14775Affected <5.5.10Fixed in 5.5.10OSV source ↗4 years ago

MediumLaravel framework susceptible to reflected cross-site scriptingGHSA-546h-56qp-8jmwCVE-2024-13918Affected >=11.9.0 <11.36.0Fixed in 11.36.0OSV source ↗2 years ago

MediumLaravel framework susceptible to reflected cross-site scriptingGHSA-83wp-f5c3-hqqrCVE-2024-13919Affected >=11.9.0 <11.36.0Fixed in 11.36.0OSV source ↗2 years ago

MediumLaravel Cross-site Scripting (XSS) vulnerability in blade templatingGHSA-vr95-p7q6-8m9qAffected >=7.0.0 <7.1.2Fixed in 7.1.2OSV source ↗2 years ago

MediumLaravel Framework: Temporary Signed URL Path ConfusionGHSA-crmm-hgp2-wgrpAffected <12.61.1, >=13.0.0 <13.12.0Fixed in 12.61.1 Fixed in 13.12.0OSV source ↗5 months ago

LowLaravel environment manipulation via query stringGHSA-gv7v-rgg6-548hBIT-laravel-2024-52301CVE-2024-52301Affected <6.20.45, >=10.0.0 <10.48.23, >=11.0.0 <11.31.0, >=7.0.0 <7.30.7, >=8.0.0 <8.83.28, >=9.0.0 <9.52.17Fixed in 10.48.23 Fixed in 11.31.0 Fixed in 6.20.45 Fixed in 7.30.7 Fixed in 8.83.28 Fixed in 9.52.17OSV source ↗2 years ago