Threats affecting pkg:github/LaraDashboard

LaraDashboard versions before 1.4.9 have a stored cross-site scripting (XSS) vulnerability. Authenticated users with post.create or post.edit permissions can inject malicious scripts via unsanitized LaraBuilder design_json block content. This allows script or event-handler markup to execute in administrator or Superadmin sessions when viewing the builder, preview, or page. The vulnerability is fixed in version 1.4.9.

LaraDashboard versions before 1.4.5 have an incorrect authorization vulnerability in the SettingPolicy::manageCoreUpgrades() function. This flaw allows administrators without Superadmin privileges but with settings.edit permission to perform Superadmin-only core upgrade operations. Exploitation enables access to backup, download, restore, and upgrade actions that can expose database dumps containing password hashes and allow site restoration or upgrades.

LaraDashboard versions 1.4.0 through 1.4.8 contain an improper authorization vulnerability allowing authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. This flaw enables attackers to mint an MCP token and send emails with arbitrary recipients, subjects, and HTML bodies, potentially facilitating phishing or spam campaigns. The issue is fixed in version 1.4.9.