Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-77hd-k355-aybk
Vulnerability ID VCID-77hd-k355-aybk
Aliases CVE-2021-21263
GHSA-3p32-j457-pg5x
Summary Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01139 https://api.first.org/data/v1/epss?cve=CVE-2021-21263
epss 0.01139 https://api.first.org/data/v1/epss?cve=CVE-2021-21263
epss 0.01139 https://api.first.org/data/v1/epss?cve=CVE-2021-21263
epss 0.01139 https://api.first.org/data/v1/epss?cve=CVE-2021-21263
cvssv3.1 7.2 https://blog.laravel.com/security-laravel-62011-7302-8221-released
generic_textual HIGH https://blog.laravel.com/security-laravel-62011-7302-8221-released
cvssv3.1 7.2 https://blog.laravel.com/security-laravel-62012-7303-released
generic_textual HIGH https://blog.laravel.com/security-laravel-62012-7303-released
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-3p32-j457-pg5x
cvssv3.1 7.2 https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/database/CVE-2021-21263.yaml
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/database/CVE-2021-21263.yaml
cvssv3.1 7.2 https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-21263.yaml
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-21263.yaml
cvssv3.1 7.2 https://github.com/laravel/framework/pull/35865
generic_textual HIGH https://github.com/laravel/framework/pull/35865
cvssv3.1 7.2 https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x
cvssv3.1_qr HIGH https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x
generic_textual HIGH https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2021-21263
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-21263
cvssv3.1 7.2 https://packagist.org/packages/illuminate/database
generic_textual HIGH https://packagist.org/packages/illuminate/database
cvssv3.1 7.2 https://packagist.org/packages/laravel/framework
generic_textual HIGH https://packagist.org/packages/laravel/framework
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-21263
https://blog.laravel.com/security-laravel-62011-7302-8221-released
https://blog.laravel.com/security-laravel-62012-7303-released
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21263
https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/database/CVE-2021-21263.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-21263.yaml
https://github.com/laravel/framework/pull/35865
https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x
https://nvd.nist.gov/vuln/detail/CVE-2021-21263
https://packagist.org/packages/illuminate/database
https://packagist.org/packages/laravel/framework
980095 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980095
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://blog.laravel.com/security-laravel-62011-7302-8221-released
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://blog.laravel.com/security-laravel-62012-7303-released
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/database/CVE-2021-21263.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-21263.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/pull/35865
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-21263
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://packagist.org/packages/illuminate/database
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://packagist.org/packages/laravel/framework
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.78825
EPSS Score 0.01139
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:28:19.619329+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0