[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":48,"vulnerability-29774":55,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":91,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":97},[4,15,21,27,33,39],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?","https:\u002F\u002Fpentest-tools.com\u002Fusage\u002Fcompliance",false,[11],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Get compliance evidence","secondary","compliance-pages-launch",{"title":16,"slug":17,"text":18,"link":8,"external":9,"targets":19,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[20],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner",{"title":22,"slug":23,"text":24,"link":8,"external":9,"targets":25,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[26],"\u002Ffeatures\u002Fpentest-reporting",{"title":28,"slug":29,"text":30,"link":8,"external":9,"targets":31,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[32],"\u002Ffeatures\u002Fintegrations",{"title":34,"slug":35,"text":36,"link":8,"external":9,"targets":37,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[38],"\u002Fexploit-helpers\u002Fsniper",{"title":40,"slug":41,"text":42,"link":43,"external":44,"targets":45,"cta":47,"variant":13,"campaign_id":41},"Office Hours #13 - Reducing tool sprawl","office-hours-13","[Live Office Hours, Wed Oct 14] How to consolidate your security testing stack without the lock-in","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_m_Won6d_SzOQ-gYhCdXU_A",true,[46],"\u002F","Save your spot",["Island",49],{"key":50,"params":51,"result":53},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":52},"{}",{"head":54},{},{"id":56,"detectable_with":57,"vuln_details":63,"vuln_id":88,"name":89,"published":90,"updated":90},29774,{"tool":58,"engine":61},{"id":59,"name":60},1,"Network Scanner",{"id":59,"name":62},"Sniper",{"id":56,"codename":64,"description":65,"severity":66,"risk_description":67,"public_description":68,"public_recommendation":69,"recommendation":70,"references":71,"cvssv3":77,"epss_score":78,"epss_percentile":79,"cve":80,"in_cisa_catalog":44,"date":82,"software_type":83,"vendor":84,"product":85,"ptt_exploit_capabilities":86},null,"We found that the target Laravel application is running the Livewire v3 package, version 3.6.3 or earlier, which is vulnerable to unauthenticated remote code execution. The vulnerability stems from a flaw in Livewire's component hydration\u002Fupdate mechanism (POST \u002Flivewire\u002Fupdate): an unauthenticated attacker can submit a crafted 'updates' payload that Livewire deserializes without properly re-validating its structure, allowing attacker-controlled data to be unmarshaled into a chain of built-in Laravel classes (Illuminate\\Broadcasting\\BroadcastEvent, PendingBroadcast, Illuminate\\Validation\\Validator) that ultimately reach an unauthenticated system() call, resulting in remote code execution as the web server user.","critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","Laravel Livewire, versions from 3.0.0-beta.1 up to and including 3.6.3, is vulnerable to unauthenticated remote code execution due to an object-injection flaw in its component hydration and update mechanism. An attacker can submit a crafted component update request that causes Livewire to unmarshal attacker-controlled data into PHP objects, chaining built-in Laravel classes to reach a system() call. Because the flaw requires no authentication, a publicly exposed Livewire v3 component can be fully compromised remotely.","Upgrade livewire\u002Flivewire to version 3.6.4 or later.","We recommend upgrading livewire\u002Flivewire to version 3.6.4 or later; if immediate upgrade is not possible, audit and restrict exposed Livewire component endpoints and avoid mounting components with array\u002Fcollection-typed public properties that accept untrusted update input until patched.",[72,73,74,75,76],"https:\u002F\u002Fgithub.com\u002Flivewire\u002Flivewire\u002Fsecurity\u002Fadvisories\u002FGHSA-29cq-5w36-x7w3","https:\u002F\u002Fgithub.com\u002Fsynacktiv\u002FLivepyre","https:\u002F\u002Fwww.synacktiv.com\u002Fen\u002Fpublications\u002Flivewire-remote-command-execution-through-unmarshaling","https:\u002F\u002Fwww.synacktiv.com\u002Fsites\u002Fdefault\u002Ffiles\u002F2025-09\u002Fslides-livewire-nullcon2025.pdf","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-54068",9.8,0.97321,0.99897,[81],"CVE-2025-54068","2025-07-17T00:00:00Z","Laravel Package","Laravel","Livewire",[87],"RCE","NETSCAN-SNIPER-CVE-2025-54068","Laravel Livewire - Remote Code Execution","2026-09-22T00:00:00Z",["Island",92],{"key":93,"params":94,"result":95},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":52},{"head":96},{},["Island",98],{"key":99,"params":100,"result":102},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":101},"{\"text-color\":\"gray\"}",{"head":103},{}]