{"id":"CVE-2024-13918","published":"2025-03-10T10:02:29Z","modified":"2025-03-10T17:02:40Z","title":"Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page","vendor":"Laravel Holdings Inc.","product":"Laravel Framework","tier":"tail","description":{"text":"The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.","provenance":"source","from":"CVE.org"},"cvss":{"score":8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.006,"percentile":0.48579,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page","tags":["third-party-advisory"]},{"url":"https://github.com/laravel/framework/pull/53869","tags":["patch"]},{"url":"https://github.com/laravel/framework/releases/tag/v11.36.0","tags":["release-notes"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/10/3","tags":[]}],"priority":{"score":15.3,"factors":[{"name":"EPSS percentile","points":9.72},{"name":"CVSS severity","points":5.6}]},"vendorSlug":"laravel-holdings","affectedVersions":[{"vendor":"Laravel Holdings Inc.","product":"Laravel Framework","versions":[">= 11.9.0, <= 11.35.1"]}],"affected":[{"ecosystem":"Packagist","package":"laravel/framework","vulnerableRanges":[">=11.9.0, <11.36.0"],"patched":["11.36.0"],"from":["GHSA-546h-56qp-8jmw"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-54196","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-21263","published":"2021-01-19","fixed":"8.22.1","kev":false},{"cve":"CVE-2021-43808","published":"2021-12-07","fixed":"8.75.0","kev":false},{"cve":"CVE-2024-52301","published":"2024-11-12","fixed":"11.31.0","kev":false,"link":{"from":"CVE-2024-52301","to":"CVE-2024-13918","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:laravel/framework","fromFixed":"11.31.0","toFixed":"11.36.0","daysApart":118}]}},{"cve":"CVE-2024-13918","published":"2025-03-10","fixed":"11.36.0","kev":false},{"cve":"CVE-2024-13919","published":"2025-03-10","fixed":"11.36.0","kev":false},{"cve":"CVE-2025-27515","published":"2025-03-05","fixed":"12.1.1","kev":false,"link":{"from":"CVE-2024-13918","to":"CVE-2025-27515","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:laravel/framework","fromFixed":"11.36.0","toFixed":"11.44.1","daysApart":-5}]}},{"cve":"CVE-2026-114508","published":"2026-10-21","fixed":"13.27.0","kev":false}],"package":"Packagist:laravel/framework"}}