Vulnerability Database

314,615

Total vulnerabilities in the database

CVE-2025-63307

alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.

  • Published: Nov 6, 2025
  • Updated: Dec 9, 2025
  • CVE: CVE-2025-63307
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 8.1
  • AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
alexusmai / laravel_file_manager 3.3.1 3.3.1.x