Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6wn3-r4pw-a3a3
Vulnerability ID VCID-6wn3-r4pw-a3a3
Aliases CVE-2021-43808
GHSA-66hf-2p6w-jqfw
Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Laravel is a web application framework. Laravel contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched by determining the parent placeholder at runtime and using a random hash that is unique to each request.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
epss 0.00359 https://api.first.org/data/v1/epss?cve=CVE-2021-43808
epss 0.00359 https://api.first.org/data/v1/epss?cve=CVE-2021-43808
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-66hf-2p6w-jqfw
cvssv3.1 6.1 https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/view/CVE-2021-43808.yaml
generic_textual MODERATE https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/view/CVE-2021-43808.yaml
cvssv3.1 6.1 https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-43808.yaml
generic_textual MODERATE https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-43808.yaml
cvssv3.1 6.1 https://github.com/laravel/framework
generic_textual MODERATE https://github.com/laravel/framework
cvssv3.1 6.1 https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
generic_textual MODERATE https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
cvssv3.1 6.1 https://github.com/laravel/framework/pull/39906
generic_textual MODERATE https://github.com/laravel/framework/pull/39906
cvssv3.1 6.1 https://github.com/laravel/framework/pull/39908
generic_textual MODERATE https://github.com/laravel/framework/pull/39908
cvssv3.1 6.1 https://github.com/laravel/framework/pull/39909
generic_textual MODERATE https://github.com/laravel/framework/pull/39909
cvssv3.1 6.1 https://github.com/laravel/framework/releases/tag/v6.20.42
generic_textual MODERATE https://github.com/laravel/framework/releases/tag/v6.20.42
cvssv3.1 6.1 https://github.com/laravel/framework/releases/tag/v7.30.6
generic_textual MODERATE https://github.com/laravel/framework/releases/tag/v7.30.6
cvssv3.1 6.1 https://github.com/laravel/framework/releases/tag/v8.75.0
generic_textual MODERATE https://github.com/laravel/framework/releases/tag/v8.75.0
cvssv3.1 6.1 https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
cvssv3.1_qr MODERATE https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
generic_textual MODERATE https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2021-43808
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-43808
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-43808
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/laravel/framework
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
1001333 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001333
CVE-2021-43808 https://nvd.nist.gov/vuln/detail/CVE-2021-43808
CVE-2021-43808.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/view/CVE-2021-43808.yaml
CVE-2021-43808.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-43808.yaml
GHSA-66hf-2p6w-jqfw https://github.com/advisories/GHSA-66hf-2p6w-jqfw
GHSA-66hf-2p6w-jqfw https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/view/CVE-2021-43808.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-43808.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/pull/39906
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/pull/39908
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/pull/39909
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/releases/tag/v6.20.42
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/releases/tag/v7.30.6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/releases/tag/v8.75.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-43808
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.58406
EPSS Score 0.00359
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:40:39.434821+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/laravel/framework/CVE-2021-43808.yml 38.6.0