Advisories · Technology
LaraDashboard.
Every CVE that names LaraDashboard among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content
- LaraDashboard
- Cross-site scripting (XSS)
- CVSS 8.6 High
LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades
- LaraDashboard
- Broken access control
- CVSS 5.3 Medium
LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool
- LaraDashboard
- Broken access control
- CVSS 6.3 Medium
LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit
- laradashboard
- Race condition
- CVSS 7.1 High
LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
- laradashboard
- Broken access control
- CVSS 5.3 Medium
LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url
- laradashboard
- Open redirect
- CVSS 6.9 Medium
LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints
- laradashboard
- Denial of service
- CVSS 8.6 High
LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering
- laradashboard
- Privilege escalation
- CVSS 6.3 Medium
LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint
- laradashboard
- Path traversal
- CVSS 7.1 High
laradashboard through 1.2.2 Missing Authorization via License API
- laradashboard
- Broken access control
- CVSS 8.6 High
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
- laradashboard
- Path traversal
- CVSS 5.1 Medium
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
- laradashboard
- Cross-site scripting (XSS)
- CVSS 7.1 High
Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch
- laradashboard
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action
- laradashboard
- Broken access control
- CVSS 8.6 High
Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload
- laradashboard
- Broken access control
- CVSS 5.3 Medium
Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
- laradashboard
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
- laradashboard
- Authentication bypass
- CVSS 8.9 High
LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain
- laradashboard
- Broken access control