CVE-2018-15133
CWE-502
93.4
RPSRPS range: 0–105; KEV-listed vulnerabilities can receive an exploitation amplifier.
Description
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
Source: NVD
Signals
- CVSS
- 8.1
- High · v3.1
- EPSS
- 76.81%
- Probability of exploitation in the next 30 days (FIRST)
- CISA KEV
- In CISA KEV since Jan 2024
- Fix commit
- No known fix commit
- Sources: MoreFixes, FreshFixes
- Weakness
- CWE-502
- Published
- 9 Aug 2018
- Last modified 7 Nov 2025
How to read these signals: RPS · EPSS · CISA KEV · Data sources
Get this score from the API
curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
https://api.intelligence.devsecure.io/api/v1/rps/CVE-2018-15133Replace the placeholder with your key. Get a free API key or rank your own CVEs.
Data as of 8 Oct 2026, 05:16 UK time