CVE-2024-13918

low-risk
Published 2025-03-10

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

Do I need to act?

-
0.11% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.0/10 High
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Laravel

References (4)

Issue Tracking https://github.com/laravel/framework/pull/53869
Release Notes https://github.com/laravel/framework/releases/tag/v11.36.0
Exploit https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_L...
Exploit http://www.openwall.com/lists/oss-security/2025/03/10/3
29
/ 100
low-risk
Severity 24/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal