Input validation error in Laravel Framework - #VU156197
Published: February 2, 2021 / Updated: October 19, 2026
Vulnerability identifier: #VU156197
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to manipulate database query bindings, potentially enabling unauthorized access to or modification of data.
The vulnerability exists due to insufficient validation of request-derived database bindings in the database component when processing requests. A remote attacker can supply request data that introduces unexpected database bindings to alter query behavior and potentially access or modify data without authorization.
Affected software
Laravel Framework
Remediation
Install security update from vendor's website.
Laravel Framework - addressed in versions 6.20.14, 7.30.4, 8.24.0