Every CVE Search/ Get API key

CVE-2025-27515

Laravel has a File Validation Bypass

6.9 MediumPublic exploitFix available

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.*), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.75%Up 0.7 points since Mar 6, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.9

Laravel has a File Validation Bypass

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.*), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Record
CVE-2025-27515
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-155
Updated
2026-11-02
EUVDEUVD-2025-6153 6.9

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.*), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Record
EUVD-2025-6153
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-78fx-h6xr-vch4 6.9

Laravel has a File Validation Bypass

When using wildcard validation to validate a given file or image field array (files.*), a user-crafted malicious request could potentially bypass the validation rules.

Record
GHSA-78fx-h6xr-vch4
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-155
Updated
2026-11-02
GitHub AdvisoriesGHSA-4mg9-vhxq-vm7j No score

SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.

Record
GHSA-4mg9-vhxq-vm7j
Weakness
CWE-89
Updated
2026-11-02
GitHub AdvisoriesGHSA-7852-w36x-6mf6 No score

Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior

The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of false. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:

<?php

$decyptedValue = decrypt($secret);

if ($decryptedValue == '') {
    // Code is run even though decrypted value is false...
}
Record
GHSA-7852-w36x-6mf6
Weakness
CWE-1240
Updated
2026-11-02
GitHub AdvisoriesGHSA-wq8p-mqvg-2p5h No score

laravel framework SQL Injection via limit and offset functions

Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.

Record
GHSA-wq8p-mqvg-2p5h
Weakness
CWE-89
Updated
2026-11-02
Show 24 moreShow less
NVD 6.9

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.*), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Record
CVE-2025-27515
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-155
Updated
2026-11-02
OSV 6.9

Laravel has a File Validation Bypass

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.*), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Record
CVE-2025-27515
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-155
Updated
2026-11-02
OSVDEBIAN-CVE-2025-27515 9.8

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.*), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Record
DEBIAN-CVE-2025-27515
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-78fx-h6xr-vch4 6.9

Laravel has a File Validation Bypass

When using wildcard validation to validate a given file or image field array (files.*), a user-crafted malicious request could potentially bypass the validation rules.

Record
GHSA-78fx-h6xr-vch4
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-155
Updated
2026-11-02
OSVBIT-laravel-2025-27515 No score

Laravel has a File Validation Bypass

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.*), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Record
BIT-laravel-2025-27515
Updated
2026-11-02
OSVCLSA-2025-1761785337 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.44.0-p1+tuxcare.

Record
CLSA-2025-1761785337
Updated
2026-11-02
OSVCLSA-2025-1761785347 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.83.29-p1+tuxcare.

Record
CLSA-2025-1761785347
Updated
2026-11-02
OSVCLSA-2026-1772239984 No score

TuxCare security update for illuminate/database (1 CVE)

TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p1+tuxcare.

Record
CLSA-2026-1772239984
Updated
2026-11-02
OSVCLSA-2026-1773017339 No score

TuxCare security update for laravel/framework (10 CVEs)

TuxCare rebuilt laravel/framework to address 10 CVEs. Fixed in 5.4.36-p2+tuxcare.

Record
CLSA-2026-1773017339
Updated
2026-11-02
OSVCLSA-2026-1773103741 No score

TuxCare security update for laravel/framework (8 CVEs)

TuxCare rebuilt laravel/framework to address 8 CVEs. Fixed in 5.5.50-p1+tuxcare.

Record
CLSA-2026-1773103741
Updated
2026-11-02
OSVCLSA-2026-1773103742 No score

TuxCare security update for laravel/framework (9 CVEs)

TuxCare rebuilt laravel/framework to address 9 CVEs. Fixed in 5.6.40-p1+tuxcare.

Record
CLSA-2026-1773103742
Updated
2026-11-02
OSVCLSA-2026-1773103743 No score

TuxCare security update for laravel/framework (9 CVEs)

TuxCare rebuilt laravel/framework to address 9 CVEs. Fixed in 5.7.29-p1+tuxcare.

Record
CLSA-2026-1773103743
Updated
2026-11-02
OSVCLSA-2026-1773362940 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.4.36-p3+tuxcare.

Record
CLSA-2026-1773362940
Updated
2026-11-02
OSVCLSA-2026-1776213253 No score

TuxCare security update for laravel/framework (8 CVEs)

TuxCare rebuilt laravel/framework to address 8 CVEs. Fixed in 8.12.1-p1+tuxcare.

Record
CLSA-2026-1776213253
Updated
2026-11-02
OSVCLSA-2026-1776213254 No score

TuxCare security update for laravel/framework (8 CVEs)

TuxCare rebuilt laravel/framework to address 8 CVEs. Fixed in 8.12.2-p1+tuxcare.

Record
CLSA-2026-1776213254
Updated
2026-11-02
OSVCLSA-2026-1776213257 No score

TuxCare security update for laravel/framework (8 CVEs)

TuxCare rebuilt laravel/framework to address 8 CVEs. Fixed in 8.12.3-p1+tuxcare.

Record
CLSA-2026-1776213257
Updated
2026-11-02
OSVCLSA-2026-1776214146 No score

TuxCare security update for laravel/framework (5 CVEs)

TuxCare rebuilt laravel/framework to address 5 CVEs. Fixed in 8.12.0-p3+tuxcare.

Record
CLSA-2026-1776214146
Updated
2026-11-02
OSVCLSA-2026-1779842936 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.48.28-p1+tuxcare.

Record
CLSA-2026-1779842936
Updated
2026-11-02
OSVCLSA-2026-1780015757 No score

TuxCare security update for laravel/framework (2 CVEs)

TuxCare rebuilt laravel/framework to address 2 CVEs. Fixed in 5.8.38-p4+tuxcare.

Record
CLSA-2026-1780015757
Updated
2026-11-02
OSVCLSA-2026-1783558967 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 9.52.21-p2+tuxcare.

Record
CLSA-2026-1783558967
Updated
2026-11-02
OSVCLSA-2026-1784077493 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 7.30.7-p2+tuxcare.

Record
CLSA-2026-1784077493
Updated
2026-11-02
OSVGHSA-4mg9-vhxq-vm7j No score

SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.

Record
GHSA-4mg9-vhxq-vm7j
Weakness
CWE-89
Updated
2026-11-02
OSVGHSA-7852-w36x-6mf6 No score

Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior

The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of false. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:

<?php

$decyptedValue = decrypt($secret);

if ($decryptedValue == '') {
    // Code is run even though decrypted value is false...
}
Record
GHSA-7852-w36x-6mf6
Weakness
CWE-1240
Updated
2026-11-02
OSVGHSA-wq8p-mqvg-2p5h No score

laravel framework SQL Injection via limit and offset functions

Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.

Record
GHSA-wq8p-mqvg-2p5h
Weakness
CWE-89
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
laravel/framework
Packagist
 8.0.0 up to 8.40.0
8.40.0
laravel/framework
Packagist
 before 6.20.26
6.20.26
illuminate/database
Packagist
 8.0.0 up to 8.40.0
8.40.0
illuminate/database
Packagist
 before 6.20.26
6.20.26
laravel/framework
Packagist
 before 5.5.40
5.5.40
laravel/framework
Packagist
 5.6.0 up to 5.6.15
5.6.15
laravel/framework
Packagist
 12.0.0 up to 12.1.1
12.1.1
laravel/framework
Packagist
 11.0.0 up to 11.44.1
11.44.1
laravel/framework
Packagist
 before 10.48.29
10.48.29
laravel/framework
Packagist
 6.0.0 up to 6.20.26
6.20.26
Show 32 moreShow less
Affected packages
PackageAffectedFixed
laravel/framework
Packagist
 7.0.0 up to 7.30.5
7.30.5
laravel
Bitnami
 before 12.2.0
12.2.0
laravel/framework
TuxCare:Packagist
 11.44.0 up to 11.44.0-p1+tuxcare
11.44.0-p1+tuxcare
laravel/framework
TuxCare:Packagist
 8.83.29 up to 8.83.29-p1+tuxcare
8.83.29-p1+tuxcare
illuminate/database
TuxCare:Packagist
 5.4.36 up to 5.4.36-p1+tuxcare
5.4.36-p1+tuxcare
laravel/framework
TuxCare:Packagist
From an advisory covering 8 CVEs
 5.4.36 up to 5.4.36-p2+tuxcare, plus listed versions
5.4.36-p1+tuxcare
5.4.36-p2+tuxcare
laravel/framework
TuxCare:Packagist
From an advisory covering 6 CVEs
 5.5.50 up to 5.5.50-p1+tuxcare
5.5.50-p1+tuxcare
laravel/framework
TuxCare:Packagist
From an advisory covering 6 CVEs
 5.6.40 up to 5.6.40-p1+tuxcare
5.6.40-p1+tuxcare
laravel/framework
TuxCare:Packagist
From an advisory covering 6 CVEs
 5.7.29 up to 5.7.29-p1+tuxcare
5.7.29-p1+tuxcare
laravel/framework
TuxCare:Packagist
 5.4.36 up to 5.4.36-p3+tuxcare, plus listed versions
5.4.36-p1+tuxcare5.4.36-p2+tuxcare
5.4.36-p3+tuxcare
laravel/framework
TuxCare:Packagist
From an advisory covering 4 CVEs
 8.12.1 up to 8.12.1-p1+tuxcare
8.12.1-p1+tuxcare
laravel/framework
TuxCare:Packagist
From an advisory covering 4 CVEs
 8.12.2 up to 8.12.2-p1+tuxcare
8.12.2-p1+tuxcare
laravel/framework
TuxCare:Packagist
From an advisory covering 4 CVEs
 8.12.3 up to 8.12.3-p1+tuxcare
8.12.3-p1+tuxcare
laravel/framework
TuxCare:Packagist
From an advisory covering 3 CVEs
 8.12.0 up to 8.12.0-p3+tuxcare, plus listed versions
8.12.0-p1+tuxcare
8.12.0-p3+tuxcare
laravel/framework
TuxCare:Packagist
 10.48.28 up to 10.48.28-p1+tuxcare
10.48.28-p1+tuxcare
laravel/framework
TuxCare:Packagist
From an advisory covering 2 CVEs
 5.8.38 up to 5.8.38-p4+tuxcare, plus listed versions
5.8.38-p1+tuxcare5.8.38-p2+tuxcare5.8.38-p3+tuxcare
5.8.38-p4+tuxcare
laravel/framework
TuxCare:Packagist
 9.52.21 up to 9.52.21-p2+tuxcare, plus listed versions
9.52.21-p1+tuxcare
9.52.21-p2+tuxcare
laravel/framework
TuxCare:Packagist
 7.30.7 up to 7.30.7-p2+tuxcare, plus listed versions
7.30.7-p1+tuxcare
7.30.7-p2+tuxcare
php-laravel-framework
Debian:12
 All versions, plus listed versions
10.48.25+dfsg-110.48.25+dfsg-210.48.29+dfsg-111.44.0-111.44.2+dfsg-1
Show 5 moreShow less
11.46.1+dfsg-111.46.1+dfsg-211.46.1+dfsg-311.46.1+dfsg-48.83.26+dfsg-2
 None known
php-laravel-framework
Debian:13
 before 10.48.29+dfsg-1
10.48.29+dfsg-1
php-laravel-framework
Debian:14
 before 10.48.29+dfsg-1
10.48.29+dfsg-1
laravel/framework
Packagist
 8.0.0 up to 8.40.0, plus listed versions
v8.0.0v8.0.1v8.0.2v8.0.3v8.0.4
Show 45 moreShow less
v8.1.0v8.10.0v8.11.0v8.11.1v8.11.2v8.12.0v8.12.1v8.12.2v8.12.3v8.13.0v8.14.0v8.15.0v8.16.0v8.16.1v8.17.0v8.17.1v8.17.2v8.18.0v8.18.1v8.19.0v8.2.0v8.20.0v8.20.1v8.21.0v8.22.0v8.22.1v8.23.0v8.23.1v8.24.0v8.25.0v8.26.0v8.26.1v8.27.0v8.28.0v8.28.1v8.29.0v8.3.0v8.30.0v8.30.1v8.31.0v8.32.0v8.32.1v8.33.0v8.33.1v8.34.0
8.40.0
laravel/framework
Packagist
 before 6.20.26, plus listed versions
5.0.305.2.41v4.0.0v4.0.0-BETA2v4.0.0-BETA3
Show 45 moreShow less
v4.0.0-BETA4v4.0.1v4.0.10v4.0.11v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.11v4.1.12v4.1.13v4.1.14v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.29v4.1.3v4.1.30v4.1.31v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0
6.20.26
illuminate/database
Packagist
 8.0.0 up to 8.40.0, plus listed versions
v8.0.0v8.0.1v8.0.2v8.0.3v8.0.4
Show 45 moreShow less
v8.1.0v8.10.0v8.11.0v8.11.1v8.11.2v8.12.0v8.12.1v8.12.2v8.12.3v8.13.0v8.14.0v8.15.0v8.16.0v8.16.1v8.17.0v8.17.2v8.18.0v8.18.1v8.19.0v8.2.0v8.20.0v8.20.1v8.21.0v8.22.0v8.22.1v8.23.1v8.24.0v8.25.0v8.26.0v8.26.1v8.27.0v8.28.0v8.28.1v8.29.0v8.3.0v8.30.0v8.30.1v8.31.0v8.32.0v8.32.1v8.33.0v8.33.1v8.34.0v8.35.0v8.35.1
8.40.0
illuminate/database
Packagist
 before 6.20.26, plus listed versions
5.7.175.7.185.7.19v1.0.0v1.1.0
Show 45 moreShow less
v1.1.1v4.0.0v4.0.0-BETA2v4.0.0-BETA3v4.0.0-BETA4v4.0.1v4.0.10v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.11v4.1.12v4.1.13v4.1.14v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.29v4.1.3v4.1.30v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8
6.20.26
laravel/framework
Packagist
 before 5.5.40, plus listed versions
5.0.305.2.41v4.0.0v4.0.0-BETA2v4.0.0-BETA3
Show 45 moreShow less
v4.0.0-BETA4v4.0.1v4.0.10v4.0.11v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.11v4.1.12v4.1.13v4.1.14v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.29v4.1.3v4.1.30v4.1.31v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0
5.5.40
laravel/framework
Packagist
 5.6.0 up to 5.6.15, plus listed versions
v5.6.0v5.6.1v5.6.10v5.6.11v5.6.12
Show 10 moreShow less
v5.6.13v5.6.14v5.6.2v5.6.3v5.6.4v5.6.5v5.6.6v5.6.7v5.6.8v5.6.9
5.6.15
laravel/framework
Packagist
 12.0.0 up to 12.1.1, plus listed versions
v12.0.0v12.0.1v12.1.0
12.1.1
laravel/framework
Packagist
 11.0.0 up to 11.44.1, plus listed versions
v11.0.0v11.0.1v11.0.2v11.0.3v11.0.4
Show 45 moreShow less
v11.0.5v11.0.6v11.0.7v11.0.8v11.1.0v11.1.1v11.10.0v11.11.0v11.11.1v11.12.0v11.13.0v11.14.0v11.15.0v11.16.0v11.17.0v11.18.0v11.18.1v11.19.0v11.2.0v11.20.0v11.21.0v11.22.0v11.23.0v11.23.1v11.23.2v11.23.3v11.23.4v11.23.5v11.24.0v11.24.1v11.25.0v11.26.0v11.27.0v11.27.1v11.27.2v11.28.0v11.28.1v11.29.0v11.3.0v11.3.1v11.30.0v11.31.0v11.32.0v11.33.0v11.33.1
11.44.1
laravel/framework
Packagist
 before 10.48.29, plus listed versions
5.0.305.2.41v10.0.0v10.0.1v10.0.2
Show 45 moreShow less
v10.0.3v10.1.0v10.1.1v10.1.2v10.1.3v10.1.4v10.1.5v10.10.0v10.10.1v10.11.0v10.12.0v10.13.0v10.13.1v10.13.2v10.13.3v10.13.5v10.14.0v10.14.1v10.15.0v10.16.0v10.16.1v10.17.0v10.17.1v10.18.0v10.19.0v10.2.0v10.20.0v10.21.0v10.21.1v10.22.0v10.23.0v10.23.1v10.24.0v10.25.0v10.25.1v10.25.2v10.26.0v10.26.1v10.26.2v10.27.0v10.28.0v10.29.0v10.3.0v10.3.1v10.3.2
10.48.29
laravel/framework
Packagist
 6.0.0 up to 6.20.26, plus listed versions
v6.0.0v6.0.1v6.0.2v6.0.3v6.0.4
Show 45 moreShow less
v6.1.0v6.10.0v6.10.1v6.11.0v6.12.0v6.13.0v6.13.1v6.14.0v6.15.0v6.15.1v6.16.0v6.17.0v6.17.1v6.18.0v6.18.1v6.18.10v6.18.11v6.18.12v6.18.13v6.18.14v6.18.15v6.18.16v6.18.17v6.18.18v6.18.19v6.18.2v6.18.20v6.18.21v6.18.22v6.18.23v6.18.24v6.18.25v6.18.26v6.18.27v6.18.28v6.18.29v6.18.3v6.18.30v6.18.31v6.18.32v6.18.33v6.18.34v6.18.35v6.18.36v6.18.37
6.20.26
laravel/framework
Packagist
 7.0.0 up to 7.30.5, plus listed versions
v7.0.0v7.0.1v7.0.2v7.0.3v7.0.4
Show 45 moreShow less
v7.0.5v7.0.6v7.0.7v7.0.8v7.1.0v7.1.1v7.1.2v7.1.3v7.10.0v7.10.1v7.10.2v7.10.3v7.11.0v7.12.0v7.13.0v7.14.0v7.14.1v7.15.0v7.16.0v7.16.1v7.17.0v7.17.1v7.17.2v7.18.0v7.19.0v7.19.1v7.2.0v7.2.1v7.2.2v7.20.0v7.21.0v7.22.0v7.22.1v7.22.2v7.22.3v7.22.4v7.23.0v7.23.1v7.23.2v7.24.0v7.25.0v7.26.0v7.26.1v7.27.0v7.28.0
7.30.5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubjoaovicdev/EXPLOIT-CVE-2025-275152025-12-30
PoC in GitHubShanks2001/Progetto-sicurezza2026-10-19

History

History
RecordedChangedSources
affected, exploits, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-27515 is a medium vulnerability (CVSS 6.9) in Flarum Framework, published April 29, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in laravel/framework 8.40.0.

References

Show 13 moreShow less
This page doesn't list everything

Left out here: 2,117 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open