p PatchFirst

CVE-2025-26159

CVE-2025-26159

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.

CVSS 6.1 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • nasirkhan/laravel-starter Packagist

    Versions
    • v1.0.0
    • v1.1.0
    • v10.0.0
    • v10.1.0
    • v10.10.0
    • v10.11.0
    • v10.12.0
    • v10.13.0
    • v10.14.0
    • v10.14.1
    • v10.15.0
    • v10.16.0
    • v10.17.0
    • v10.18.0
    • v10.2.0
    • v10.3.0
    • v10.3.1
    • v10.4.0
    • v10.5.0
    • v10.6.0
    • v10.7.0
    • v10.7.1
    • v10.8.0
    • v10.8.1
    • v10.9.0
    • v11.0.0
    • v11.0.1
    • v11.1.0
    • v11.10.0
    • v11.2.0
    • v11.3.0
    • v11.4.0
    • v11.5.0
    • v11.6.0
    • v11.7.0
    • v11.8.0
    • v11.9.0
    • v2.0.0
    • v3.6.0
    • v5.1.0
    • v6.0.0
    • v7.10.0
    • v7.11.0
    • v7.12.0
    • v7.14.0
    • v7.5.0
    • v7.9.0
    • v8.0.0
    • v8.1.0
    • v8.2.1
    • v8.3.0
    • v8.4.1
    • v8.4.2
    • v9.0.0
    • v9.1.0
    • v9.10.0
    • v9.11.0
    • v9.12.0
    • v9.13.0
    • v9.14.0
    • v9.15.0
    • v9.16.0
    Affected ranges
    • ECOSYSTEM: < 11.11.0

    Update to 11.11.0

Original sources

Check your server →