p PatchFirst

PatchFirst · Latest vulnerabilities

illuminate/database vulnerabilities

Vulnerabilities published for illuminate/database in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 5

  1. GHSA-cc2w-ghc5-m5qr

    Not ratedFix available

    Laravel Risk of mass-assignment vulnerabilities

    Laravel 4.1.29 improves the column quoting for all database drivers. This protects your application from some mass assignment vulnerabilities when not using the fillable property on models. If you are using the fillable property on your models to protect against mass assignment, your application is not vulnerable. However, if you are using guarded and are passing a user controlled array into an "update" or "save" type function, you should upgrade to 4.1.29 immediately as your application may be at risk of mass assignment.

    illuminate/databasePHP
    • Update to 4.1.29
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-4mg9-vhxq-vm7j

    Not ratedFix available

    SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

    ### Impact Those using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability. ### Patches This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0. ### Workarounds You may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.

    illuminate/database illuminate/databasePHP
    • Update to 6.20.26
    • Update to 8.40.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. GHSA-x7p5-p2c9-phvg

    High · CVSS 7.2Fix available

    Unexpected database bindings

    This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.

    illuminate/database illuminate/database illuminate/databasePHP
    • Update to 6.20.14
    • Update to 7.30.4
    • Update to 8.24.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2021-21263

    High · CVSS 7.2EPSS 1.62%Fix available

    Query Binding Exploitation in Laravel

    Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the

    illuminate/database illuminate/database illuminate/databasePHP
    • Update to 6.20.12
    • Update to 7.30.3
    • Update to 8.22.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →