Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Framework — Vulnerabilities & Security Advisories 30

All 30 CVE vulnerabilities found in Framework, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the Framework product, categorized by vendor advisories, specific weakness types, and relevant security tags. It collects a comprehensive history of reported flaws ranging from initial release incidents to the most recent disclosures, covering the entire lifecycle of the software. Readers can utilize this resource to track official vendor advisories, analyze patterns within a specific weakness class, or review the complete vulnerability history of the Framework product. The data presented here focuses on technical details and remediation guidance without promotional language or marketing commentary. By centralizing these records, the page enables security professionals to perform efficient risk assessments and prioritize patching efforts based on verified information. Users seeking to understand the evolution of security issues within this software ecosystem will find structured entries that facilitate quick identification of affected versions and recommended fixes. This collection serves as a definitive reference for maintaining the security posture of systems relying on Framework components. All entries are curated to ensure accuracy and relevance for defensive security operations. The page supports ongoing monitoring and historical analysis essential for robust application security management.

Vendor: GraniteDS

CVE ID Title CVSS Severity Published
CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials CWE-287 9.2 Critical 2026-10-21
CVE-2026-114508 Laravel relationship inclusion can trigger unauthorized data destruction CWE-470 6.5 Medium 2026-10-21
CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8 CWE-667 8.7 High 2026-10-21
CVE-2026-102279 Laravel: XSS in Debug Page Information CWE-80 3.1 Low 2026-09-28
CVE-2026-48019 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay CWE-93 8.9 High 2026-09-04
CVE-2026-78654 cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution CWE-1321 7.3 High 2026-08-25
CVE-2026-73661 FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup CWE-15 8.6 High 2026-08-13
CVE-2026-41887 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) CWE-22 4.9 Medium 2026-05-08
CVE-2025-67722 Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation CWE-426 7.8AI High AI 2025-12-16
CVE-2025-66039 FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header CWE-287 7.4AI High AI 2025-12-09
CVE-2025-59056 FreePBX vulnerable to unauthenticated Denial of Service CWE-22 3.8AI Low AI 2025-09-15
CVE-2025-55211 FreePBX Post-Authenticated Command Injection CWE-78 7.2AI High AI 2025-09-15
CVE-2025-3590 Adianti Framework deserialization CWE-502 6.3 Medium 2025-04-14
CVE-2025-27794 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CWE-74 6.8 Medium 2025-03-12
CVE-2025-27515 Laravel has a File Validation Bypass CWE-155 6.5 - 2025-03-05
CVE-2020-12492 Wifi information acquisition vulnerability in Framework Services CWE-306 7.5AI High AI 2024-11-25
CVE-2020-12491 Framework Information Disclosure Vulnerability CWE-306 5.5AI Medium AI 2024-11-25
CVE-2024-52301 Laravel allows environment manipulation via query string CWE-88 6.5AI Medium AI 2024-11-12
CVE-2024-21641 Flarum's Logout Route allows open redirects CWE-601 6.5 Medium 2024-01-05
CVE-2023-40033 Server-Side Request Forgery via Avatar upload in flarum CWE-918 7.1 High 2023-08-16
CVE-2023-27577 Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum CWE-22 6.6 Medium 2023-03-10
CVE-2023-22489 Flarum is missing authorization in discussion replies CWE-862 3.5 Low 2023-01-13
CVE-2023-22488 Missing authorization in Flarum CWE-862 6.8 Medium 2023-01-12
CVE-2023-22487 Post mentions can be used to read any post on the forum without access control CWE-284 7.7 High 2023-01-11
CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum CWE-79 9.0 Critical 2022-11-19
CVE-2021-43808 Blade `@parent` Exploitation Leading To Possible XSS in Laravel CWE-79 5.3 Medium 2021-12-07
CVE-2021-32831 Code injection in total.js CWE-94 7.5 High 2021-08-30
CVE-2021-21263 Query Binding Exploitation in Laravel CWE-74 7.2 High 2021-01-19
CVE-2017-3199 GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization CWE-502 8.1 - 2018-06-11
CVE-2017-3200 The implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code control CWE-913 8.1 - 2018-06-11

All 30 known CVE vulnerabilities affecting Framework with full Chinese analysis, references, and POCs where available.