CVE-2026-120488
Deferred Deferred - Pending Action

Stored XSS in LaraDashboard via LaraBuilder Design JSON

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120488

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LaraDashboard LaraDashboard 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120488 is a stored cross-site scripting (XSS) vulnerability in LaraDashboard versions before 1.4.9. It allows authenticated users with post.create or post.edit permissions to inject malicious scripts via unsanitized LaraBuilder design_json block content. Attackers can save blocks containing script or event-handler markup that executes when viewed by administrators or Superadmins in the builder, preview, or page.

Detection Guidance

Check for LaraDashboard versions before 1.4.9. Inspect posts with LaraBuilder blocks for unsanitized HTML/JS in design_json. Look for admin preview pages executing scripts. Review server logs for suspicious post edits by low-privilege users.

Impact Analysis

This vulnerability can lead to session hijacking, CSRF attacks, or full admin account takeover if chained with other vulnerabilities. Attackers can execute arbitrary JavaScript in admin sessions, potentially stealing sensitive data or performing unauthorized actions.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by allowing unauthorized access to sensitive data through script execution in admin sessions. It compromises data integrity and confidentiality, potentially leading to compliance breaches and legal consequences.

Mitigation Strategies

Upgrade LaraDashboard to version 1.4.9 or later. Sanitize all user-generated content in LaraBuilder blocks using HTMLPurifier or DOMPurifier. Restrict post.create and post.edit permissions to trusted users. Monitor admin sessions for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...