Vulnerabilidades do Laravel Framework
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Laravel Framework: 2 registro(s), com versões afetadas e correções.
CVE-2026-102279
Baixa · 3.1
CWE-80 28/09/2026
Laravel: XSS in Debug Page Information
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
CVE-2026-48019
Alta · 8.9
CWE-93 04/09/2026
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.