#Laravel

exploit 2025-06-13

SmartEnd Laravel CMS: Authenticated Privilege Escalation via Role Tampering

The SmartEnd research repository documents an authenticated privilege-escalation issue in the SmartEnd Laravel CMS. A low-privilege authenticated user can potentially manipulate the permissions_id value used by the user-role update functionality and obtain elevated privileges.

4 min read read

exploit 2024-11-21

Voyager Laravel: Authenticated Arbitrary Local File Download via Compass

The Voyager Laravel research repository documents an authenticated arbitrary local file download issue in the Compass tool. A user with valid administrative access can potentially abuse the file-download functionality to retrieve files outside the intended application scope.

4 min read read