Current: English
Posts tagged Laravel.
Winter CMS has addressed a high-severity stored cross-site scripting vulnerability affecting its backend branding functionality
The Vebto Platform research repository documents a multi-stage unauthenticated remote code execution chain affecting the shared foundation used by products such as BeLink, BeDesk, BeDrive, BeMusic, MTDB, and Architect. The chain combines a social-authentication bypass with unsafe file-storage contro...
The Acelle Mail research repository documents a multi-stage unauthenticated remote code execution chain affecting version 4.2.0-p97. The chain combines public account creation, subscription assignment, authentication bypass, unsafe Twig template processing, and a public campaign-preview route.
The Acelle Mail research repository documents a multi-stage unauthenticated compromise chain affecting versions through 4.0.24. The chain begins with arbitrary file disclosure through path traversal and can escalate through exposed application secrets, authentication weaknesses, and unsafe file-writ...
Authenticated Arbitrary File Upload via Support Ticket Attachment
The ApexForum research repository documents an authenticated arbitrary file upload vulnerability in a Laravel-based forum application. The upload endpoint does not adequately validate file type and can store dangerous content in a publicly accessible directory.
The MagicAI research repository documents an authenticated arbitrary file upload vulnerability in the Laravel + Vue SaaS application. The issue affects the chat file-analyzer upload feature, where insufficient validation between a declared MIME type and the actual file content can allow dangerous co...
The Davinci AI research repository documents an Insecure Direct Object Reference vulnerability in the team-management functionality of a Laravel + Vue SaaS application. An authenticated user can potentially manipulate team data belonging to other users by changing a user-controlled team identifier.
The WorkDo research repository documents an authenticated privilege-escalation issue affecting multiple Laravel-based WorkDo products. The issue is associated with account creation and role assignment, where a user-controlled role identifier can potentially be manipulated to obtain a higher-privileg...