p PatchFirst

CVE-2024-13918

CVE-2024-13918 · Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

CVSS 8.0 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • laravel framework

    Versions
    • ≥ 11.9.0, ≤ 11.35.1: Affected (custom)

    No fix published

  • laravel/framework Packagist

    Versions
    • v11.10.0
    • v11.11.0
    • v11.11.1
    • v11.12.0
    • v11.13.0
    • v11.14.0
    • v11.15.0
    • v11.16.0
    • v11.17.0
    • v11.18.0
    • v11.18.1
    • v11.19.0
    • v11.20.0
    • v11.21.0
    • v11.22.0
    • v11.23.0
    • v11.23.1
    • v11.23.2
    • v11.23.3
    • v11.23.4
    • v11.23.5
    • v11.24.0
    • v11.24.1
    • v11.25.0
    • v11.26.0
    • v11.27.0
    • v11.27.1
    • v11.27.2
    • v11.28.0
    • v11.28.1
    • v11.29.0
    • v11.30.0
    • v11.31.0
    • v11.32.0
    • v11.33.0
    • v11.33.1
    • v11.33.2
    • v11.34.0
    • v11.34.1
    • v11.34.2
    • v11.35.0
    • v11.35.1
    • v11.9.0
    • v11.9.1
    • v11.9.2
    Affected ranges
    • ECOSYSTEM: ≥ 11.9.0, < 11.36.0

    Update to 11.36.0

Original sources

Check your server →