p PatchFirst

CVE-2025-49130

CVE-2025-49130 · Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Only authenticated users with access to the translation manager are impacted. The issue is fixed in version 0.6.8.

CVSS 6.0 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • laravel-translation-manager

    Versions
    • < 0.6.8: Affected

    No fix published

  • barryvdh/laravel-translation-manager Packagist

    Versions
    • v0.1.0
    • v0.1.1
    • v0.1.2
    • v0.1.3
    • v0.1.4
    • v0.2.0
    • v0.2.1
    • v0.2.2
    • v0.2.3
    • v0.2.4
    • v0.2.5
    • v0.2.6
    • v0.2.7
    • v0.2.8
    • v0.2.9
    • v0.3.0
    • v0.4.0
    • v0.4.1
    • v0.4.2
    • v0.5.0
    • v0.5.1
    • v0.5.10
    • v0.5.2
    • v0.5.3
    • v0.5.4
    • v0.5.5
    • v0.5.6
    • v0.5.7
    • v0.5.8
    • v0.5.9
    • v0.6.0
    • v0.6.1
    • v0.6.2
    • v0.6.3
    • v0.6.4
    • v0.6.5
    • v0.6.6
    • v0.6.7
    Affected ranges
    • ECOSYSTEM: < 0.6.8

    Update to 0.6.8

Original sources

Check your server →