Total
3 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-43996 | 1 Facade | 1 Ignition | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control. | |||||
| CVE-2021-3129 | 2 Facade, Laravel | 2 Ignition, Laravel | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2. | |||||
| CVE-2020-13909 | 1 Facade | 1 Ignition | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix. | |||||