CVE-2024-13918

published 2025-03-10

CVE-2024-13918: The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters…

Priority P4 24 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	php-laravel-framework	—	—
laravel	framework	>= 11.9.0 < 11.36.0	11.36.0
laravel	framework	>= 11.9.0 < 11.36.0	11.36.0
laravel_holdings_inc	laravel_framework	11.9.0 – 11.35.1	—

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vendor_debian 8.0 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79