Bitnami package
laravel
pkg:bitnami/laravel
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-27515 | — | < 12.2.0 | 12.2.0 | Mar 5, 2025 | Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1. | ||
| CVE-2024-52301 | — | < 6.20.45 | 6.20.45 | Nov 12, 2024 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45 | ||
| CVE-2021-28254 | — | >= 8.5.9, < 8.5.10 | 8.5.10 | Apr 18, 2023 | A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands. | ||
| CVE-2022-2886 | — | >= 5.1.0, < 5.1.47 | 5.1.47 | Aug 19, 2022 | A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of t | ||
| CVE-2022-2870 | — | >= 5.1.0, < 5.1.47 | 5.1.47 | Aug 17, 2022 | A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-20 | ||
| CVE-2021-21263 | — | >= 6.0.0, < 6.20.11 | 6.20.11 | Jan 19, 2021 | Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non- | ||
| CVE-2020-24940 | — | < 6.18.34 | 6.18.34 | Sep 4, 2020 | An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment. | ||
| CVE-2020-24941 | — | < 6.18.35 | 6.18.35 | Sep 4, 2020 | An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions. |
- CVE-2025-27515Mar 5, 2025affected < 12.2.0fixed 12.2.0
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
- CVE-2024-52301Nov 12, 2024affected < 6.20.45fixed 6.20.45
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45
- CVE-2021-28254Apr 18, 2023affected >= 8.5.9, < 8.5.10fixed 8.5.10
A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.
- CVE-2022-2886Aug 19, 2022affected >= 5.1.0, < 5.1.47fixed 5.1.47
A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of t
- CVE-2022-2870Aug 17, 2022affected >= 5.1.0, < 5.1.47fixed 5.1.47
A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-20
- CVE-2021-21263Jan 19, 2021affected >= 6.0.0, < 6.20.11fixed 6.20.11
Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-
- CVE-2020-24940Sep 4, 2020affected < 6.18.34fixed 6.18.34
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.
- CVE-2020-24941Sep 4, 2020affected < 6.18.35fixed 6.18.35
An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.