GitHub Advisoryadvisory · Packagist

GHSA-fpx3-h2pc-88vf Laravel Starter Cross Site Scripting (XSS)

MEDIUM Published 2025-04-22 Modified 2025-04-22 Official page ↗
Aliases
CVE-2025-26159
Ecosystem
Packagist
Packages
nasirkhan/laravel-starter
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-04-22

Affected packages

• Packagist nasirkhan/laravel-starter: < 11.11.0 → fixed in 11.11.0

Description

Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.

Related

Alias · CVE (1)

  • CVE-2025-26159 Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References