3.1
CVE-2026-102279
- EPSS 0.2%
- Veröffentlicht 28.09.2026 21:17:16
- Zuletzt bearbeitet 30.09.2026 19:38:27
- Erkennungen
Laravel: XSS in Debug Page Information
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerlaravel
≫
Produkt
framework
Version
< 12.69.0
Status
affected
Version
>= 13.0.0, < 13.30.0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.09 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 3.1 | 1.6 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
|
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
https://github.com/laravel/framework/pull/61381
https://github.com/laravel/framework/releases/tag/v12.69.0
https://github.com/laravel/framework/releases/tag/v13.30.0
https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8