PT-2025-24437 · Unknown · Laravel Translation Manager

Artem Danilov + 5 · Published 2025-05-15 · Updated 2025-06-09 · CVE-2025-49130

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Laravel Translation Manager versions prior to 0.6.8

Description The application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Only authenticated users with access to the translation manager are impacted.

Recommendations For versions prior to 0.6.8, update to version 0.6.8 to resolve the issue. As a temporary workaround, consider restricting access to the translation manager to minimize the risk of exploitation. Additionally, ensure that all user-input data is properly validated and sanitized to prevent malicious activities.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-08461

CVE-2025-49130

GHSA-J226-63J7-QRQH

Affected Products

Laravel Translation Manager

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49130.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-49130 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j226-63j7-qrqh · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08461 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-49130 · Security Note
• https://github.com/barryvdh/laravel-translation-manager/releases/tag/v0.6.8) · Note
• https://github.com/barryvdh/laravel-translation-manager/pull/475 · Note
• https://github.com/barryvdh/laravel-translation-manager · Note
• https://github.com/barryvdh/laravel-translation-manager/security/advisories/GHSA-j226-63j7-qrqh · Note
• https://github.com/barryvdh/laravel-translation-manager/releases/tag/v0.6.8 · Note
• https://github.com/barryvdh/laravel-translation-manager/commit/527446ed419f90f2319675fc5211cb8f851d7a1f · Note
• https://twitter.com/VulmonFeeds/status/1932108474042773723 · Twitter Post
• https://t.me/cvetracker/25783 · Telegram Post