Now
Everything discovered across the Laravel and PHP ecosystem, newest first: releases, packages, security advisories, GitHub activity and tutorials.
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine. Given the following two Blade templates: resources/views/parent.blade.php: html @section('content') @show resources/views/child.blade.php: htm…
An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.
This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated …