6.5Media

CVE-2020-36950Laravel Nova 3.7.0 - 'range' DoS

Laravel Holdings Inc. Laravel Nova Publicada: 2026-01-27 18:23 (hace 9 meses)

Descripción

Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.

Debilidad (CWE): CWE-770

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
laravel	laravel	3.7.0
Laravel Holdings Inc.	Laravel Nova	3.7.0

Referencias y parches

ExploitDB-49198 exploit
Laravel Nova Official Homepage product
Laravel Nova Releases Page patch
VulnCheck Advisory: Laravel Nova 3.7.0 - 'range' DoS third-party-advisory

Puntuación CVSS

6.5Media

Fuente: VulnCheck · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Ninguno
Integridad: Ninguno
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Todas las puntuaciones (4)

cna	CVSS 4.0	8.7Alta
cna	CVSS 3.1	6.5Media
disclosure@vulncheck.com	CVSS 4.0	8.7Alta
disclosure@vulncheck.com	CVSS 3.1	6.5Media

EPSS (probabilidad de explotación en 30 días)

0.38%

superior al 32 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: yes
Impacto técnico: partial

Cronología

ID reservado2026-01-25
Publicada2026-01-27 18:23
Llegó a IP-DB2026-10-25 00:05
Última actualización2026-08-14 19:49

Asignada por (CNA): VulnCheck
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Laravel

9.2Crítica

CVE-2026-114509 hace 20 días

Laravel TokenGuard authentication bypass through non-string API credentials

laravel framework

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

1.8%EPSS

6.5Media

CVE-2026-114508 hace 20 días

Laravel relationship inclusion can trigger unauthorized data destruction

laravel framework

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no w…

3.1Baja

CVE-2026-102279 hace 1 mes

Laravel: XSS in Debug Page Information

laravel framework

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user ho…

8.9Alta

CVE-2026-48019 hace 2 meses

CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

laravel framework

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

8.4Alta

CVE-2021-47756 hace 9 meses

Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)

Laravel Laravel Valet

Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the symlinked valet command to execute arbitrary code with root permissions without…

8.0Alta

CVE-2024-13919 hace 1 año

Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

Laravel Holdings Inc. Laravel Framework

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.