Executive Summary

Informations
Name CVE-2025-54068 First vendor Publication 2025-07-17
Vendor Cve Last vendor Modification 2025-07-17

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54068

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-94 Failure to Control Generation of Code ('Code Injection')

Sources (Detail)

https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a...
https://github.com/livewire/livewire/releases/tag/v3.6.4
https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2025-07-19 02:39:05
  • Multiple Updates
2025-07-19 02:38:51
  • Multiple Updates
2025-07-18 17:20:34
  • Multiple Updates
2025-07-18 00:20:34
  • First insertion