{"action":"Upgrade laravel/framework to 11.36.0 or later.","affected":[{"fixed":"11.36.0","introduced":"11.9.0"}],"component":"laravel/framework","cve_ids":["CVE-2024-13918"],"ecosystem":"Packagist","epss":0.006,"exploited":false,"fixed_versions":["11.36.0"],"ghsa_id":"GHSA-546h-56qp-8jmw","id":"tcs_01M5KEVJJSTKJKZ3D6072QZVFX","modified_at":"2025-03-11T14:52:15.641880Z","published_at":"2025-03-10T12:30:55Z","references":["https://osv.dev/vulnerability/GHSA-546h-56qp-8jmw","https://nvd.nist.gov/vuln/detail/CVE-2024-13918","https://github.com/laravel/framework/pull/53869","https://github.com/laravel/framework/commit/45287fb2a91c69bb1c110539b9b7341faf5aee33","https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-13918.yaml","https://github.com/laravel/framework","https://github.com/laravel/framework/releases/tag/v11.36.0","https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page","http://www.openwall.com/lists/oss-security/2025/03/10/3"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-546h-56qp-8jmw","url":"https://osv.dev/vulnerability/GHSA-546h-56qp-8jmw"}],"summary":"Laravel framework susceptible to reflected cross-site scripting"}