What’s Vulnerable › Vulnerabilities

CVE-2021-28254

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-19 · updated 2026-06-17
• Weakness: CWE-502

Description

A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.

Affected products

• Laravel Framework: 8.5.9

References

• https://s1mple-top.github.io/2021/03/09/Laravel8-new-pop-chain-mining-process/
• https://s1mple-top.github.io/2021/03/09/Laravel8-new-pop-chain-mining-process/

Get alerted when CVE-2021-28254 or the next vulnerability affects your stack