// lab.riset.keamanan

Riset Kerentanan Laravel

Analisis mendalam kerentanan ekosistem Laravel — paket composer, rantai CVE, dan jalur eksploitasi tanpa autentikasi.

Riset Terbaru Lihat Database CVE

Artikel Terbaru

CVE-2025-54068 Kritis Patched

CVE-2025-54068 — Laravel Livewire RCE via Unmarshaling (Pre-Auth, Critical)

Kerentanan kritis pada Livewire v3 (3.0.0-beta.1–3.6.3): penyerang tanpa autentikasi dapat RCE melalui manipulasi hydration/synthesizer pada endpoint /livewire/update. Patch: v3.6.4+.

livewire/livewire Jan 08, 2026 3 menit baca

CVE

Kerentanan Unggulan

Temuan kritis dari audit paket Laravel

Lihat semua →

CVE-2026-31843 Kritis PoC Tersedia

Pay-Uz Unauthenticated File Write → RCE

Unauthenticated editable API overwrites payment hook PHP files executed via webhook handlers.

goodoneuz/pay-uz < 4.0.0 Jan 15, 2026

Selengkapnya

CVE-2025-14894 Tinggi Sudah Ditambal

Livewire Filemanager Unauth Upload RCE

Missing MIME validation on Livewire upload component enables PHP shell upload.

livewire-filemanager/filemanager < 1.0.5 Aug 01, 2025

Selengkapnya

CVE-2025-53833 Kritis Sudah Ditambal

LaRecipe SSTI → Remote Code Execution

Server-side template injection via query string in public documentation routes.

binarytorch/larecipe < 2.8.1 Jul 14, 2025

Selengkapnya

Recon Cepat

terminal — bash

❯ curl -sk https://target/payment/dashboard
composer show goodoneuz/pay-uz | grep versions
grep -E "pay-uz|larecipe|livewire" composer.lock▌