Live › vulnerability › CVE-2026-120488
LaraDashboard before 1.4.9 does not sanitize content in its LaraBuilder design blocks, so a user with post create or edit permission can save script markup that stores in the page. When an administrator or Superadmin opens the builder, preview or page, that script runs in their session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams that run LaraDashboard below 1.4.9 and give content editing rights (post.create or post.edit) to people beyond trusted staff. The risk is to administrators and Superadmins who open pages in the builder or preview. Installations on 1.4.9 or later, or where only fully trusted editors can change content, are lower risk.
No product ranges from the sources yet.
1.4.9 or later.post.create or post.edit permission and confirm they are trusted.design_json blocks for script or event-handler markup.1.4.9 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.
This page as .md · .json · in your agent: get_signal("CVE-2026-120488")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.