CVE-2024-13918

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Laravel Holdings Inc.	Laravel Framework	>= 11.9.0, <= 11.35.1

References

https://github.com/laravel/framework/pull/53869Issue Tracking, Patch
https://github.com/laravel/framework/releases/tag/v11.36.0Release Notes
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_PageExploit
http://www.openwall.com/lists/oss-security/2025/03/10/3Exploit, Mailing List, Third Party Advisory

Timeline

Published: Mar 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-139196.1The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of r CVE-2024-13925.4The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button1_icon' attribute of the Dual CVE-2024-139204.9The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi CVE-2024-139217.2The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includ CVE-2024-139226.5The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path CVE-2024-139236.5The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and CVE-2024-139249.1The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and includin CVE-2024-139257.5The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attac CVE-2024-139267.5The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number o CVE-2024-139287.2SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentia CVE-2024-139297.2Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue CVE-2024-13935.4The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content