CVE-2023-36825

Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.

• CWE-502

• https://github.com/orchidsoftware/platform/releases/tag/14.5.0Release Notes
• https://github.com/orchidsoftware/platform/security/advisories/GHSA-ph6g-p72v-pc3pVendor Advisory
• https://github.com/orchidsoftware/platform/releases/tag/14.5.0Release Notes
• https://github.com/orchidsoftware/platform/security/advisories/GHSA-ph6g-p72v-pc3pVendor Advisory

Published

Jul 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3682A vulnerability, which was classified as critical, was found…9.8
• CVE-2023-36820Micronaut Security is a security solution for applications. …6.5
• CVE-2023-36821Uptime Kuma, a self-hosted monitoring tool, allows an authen…8.8
• CVE-2023-36822Uptime Kuma, a self-hosted monitoring tool, has a path trave…8.1
• CVE-2023-36823Sanitize is an allowlist-based HTML and CSS sanitizer. Using…6.1
• CVE-2023-36824Redis is an in-memory database that persists on disk. In Red…8.8
• CVE-2023-36826Sentry is an error tracking and performance monitoring platf…6.5
• CVE-2023-36827Fides is an open-source privacy engineering platform for man…7.5
• CVE-2023-36828Statamic is a flat-first, Laravel and Git powered content ma…5.4
• CVE-2023-36829Sentry is an error tracking and performance monitoring platf…5.4
• CVE-2023-3683A vulnerability has been found in LivelyWorks Articart 2.0.1…5.4
• CVE-2023-36830SQLFluff is a SQL linter. Prior to version 2.1.2, in environ…7.8