CVE-2024-29291

Not scored yetLast modified Jun 17, 2026

Description

An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
laravel	framework	8

References

Timeline

Published: Apr 16, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-292929.1Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to exe CVE-2024-292965.3A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference CVE-2024-29309.8A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. Affected by this vulnerability is an u CVE-2024-293017.5SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-admin.php?admin_id=CVE-2024-293027.5SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-employee.php.CVE-2024-293039.8The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection CVE-2024-293097.7An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service.CVE-2024-29314.3The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.CVE-2024-293166.3NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group v CVE-2024-293185.4Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascri CVE-2024-293199.8Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make CVE-2024-29327.5A vulnerability classified as critical has been found in SourceCodester Online Chatting System 1.0. Affected is an unknown function of the f