Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

facade/ignition

3 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 critical
Registry
Packagist

Advisories 3

  • The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect…

    Affected: fixed in 1.16.15; from 2.0.0, fixed in 2.0.6.

  • CVE-2021-3129Critical 9.8 · KEV

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of i

    Affected: from 2.5.0, fixed in 2.5.2; from 2.0.0, fixed in 2.4.2; from 1.7.0, fixed in 1.16.14; fixed in 1.6.15.

  • The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env.

    Affected: from 2.0.0, fixed in 2.0.5; fixed in 1.16.15.