Security advisories

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

• facturascripts/facturascripts

  Affected

  <=2026.1

  Fixed in

  2026.2

Original advisory (GitHub Advisory Database)

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

• facturascripts/facturascripts

  Affected

  >=2025, <=2026.2

  Fixed in

  2026.3

Original advisory (GitHub Advisory Database)

Twig: PHP code injection via `{% use %}` template name

• twig/twig

  Affected

  >=1.15.1, <3.26.0

  Fixed in

  3.26.0

Original advisory (GitHub Advisory Database)

Livewire is vulnerable to remote command execution during component property update hydration

• livewire/livewire

  Affected

  >=3.0.0-beta.1, <3.6.4

  Fixed in

  3.6.4

Original advisory (Packagist security advisories)

Laravel RCE vulnerability in "cookie" session driver

Applications using the "cookie" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of…

• laravel/framework

  Affected

  >=4.1.0, <6.18.31>=7.0.0, <7.22.4

  Fixed in

  6.18.317.22.4

Original advisory (Packagist security advisories)

Laravel Framework Deserialization Vulnerability

The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the PendingCommand class in PendingCommand.php.

• laravel/framework

  Affected

  >=5.7.0, <6.20.44

  Fixed in

  6.20.44

Original advisory (Packagist security advisories)

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value t…

• laravel/framework

  Affected

  >=13.0.0, <13.27.0>=12.0.0, <12.68.0>=11.0.0, <11.56.1<10.50.4

  Fixed in

  10.50.411.56.112.68.013.27.0

Original advisory (Packagist security advisories)