Common Laravel security vulnerabilities include SQL injection, cross-site scripting (XSS), command injection, and CSRF attacks. Here's a step-by-step guide to fixing these vulnerabilities:

1. SQL Injection: Use parameterized queries or prepared statements to prevent SQL injection attacks. This can be achieved by using Laravel's built-in Eloquent ORM or raw queries. Example: Using the Eloquent ORM

$user = User::where('username', $username)->first();

Example: Using raw queries

$user = DB::select("SELECT * FROM users WHERE username = :username", ['username' => $username]);

2. Cross-site Scripting (XSS): Use Laravel's built-in methods to escape user input and output in HTML. Example: Escaping user input

{{{ $user->name }}}

Example: Using the Html::entities() method

echo Html::entities($user->name);

3. Command Injection: Use Laravel's built-in methods to escape shell commands and arguments. Example: Escaping shell commands

$command = 'rm -rf /';
shell_exec(escapeshellcmd($command));

Example: Using the Process class

use Symfony\Component\Process\Process;

$process = new Process(['rm', '-rf', '/']);
$process->run();

4. CSRF Attacks: Use Laravel's built-in CSRF token protection to prevent cross-site request forgery attacks. Example: Generating a CSRF token in a form

<form action="/submit" method="POST">
    @csrf
    <input type="text" name="name">
    <button type="submit">Submit</button>
</form>

Example: Validating the CSRF token in a controller

public function submit(Request $request) {
    if ($request->session()->token() !== $request->_token) {
        throw new \Exception('Invalid CSRF token');
    }
    // process request
}

By following these guidelines, you can help prevent many common Laravel security vulnerabilities and ensure that your application is secure against attacks.