LLaravel-Backpack

Products

Exploited and recent CVEs

• CVE-2026-54181 Medium 5.4 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted 0.3%
• CVE-2026-54177 Medium 6.6 backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver 0.9%
• CVE-2026-54176 Medium 6.5 backpack/crud: MyAccountController allows changing the login email without a current-password check 0.7%
• CVE-2026-54180 High 7.6 backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) 0.5%
• CVE-2026-57570 Medium 6.5 backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation 0.4%
• CVE-2026-54178 High 8.1 backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk 0.6%
• CVE-2026-54182 High 8.1 backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) 0.8%
• CVE-2026-54175 High 7.6 backpack/crud: Unverified password change in MyAccountController via mass assignment 0.6%
• CVE-2026-54179 Medium 4.4 backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk 0.3%
• CVE-2022-31114 Medium 5.1 backpack/crud Vulnerable to Cross-site Scripting 0.3%
• CVE-2024-52306 High 7.7 FileManager Deserialization of Untrusted Data 0.6%