OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-102279

LOW · CVSS 3.1 EPSS 0.20% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-28 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

Laravel versions prior to 12.69.0 and 13.30.0 are vulnerable to DOM-based cross-site scripting due to the improper handling of attacker-controlled input in debug pages when APP_DEBUG is set to true. This vulnerability allows an attacker to inject malicious scripts that execute when a user hovers over a tooltip. Developers and organizations using affected Laravel versions should prioritize updating to the latest versions to mitigate this security risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-102279
Severity
LOW
CVSS
3.1
EPSS
0.20%

Original NVD Description

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.