Security
فارسی
All products

backpack/crud

Composer · Package
11 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDiskCVE-2026-54178 · GHSA-8XJM-WQRP-2F25 backpack/crud Composer High Fix reported
backpack/crud is vulnerable to Cross-Site Scripting (XSS)CVE-2022-31114 · GHSA-M8XX-3X29-84H8 backpack/crud Composer Medium Fix reported
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are invertedCVE-2026-54181 · GHSA-MMG4-322V-6JVC backpack/crud Composer Medium Fix reported
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password checkCVE-2026-54176 · GHSA-9FW9-8C49-QCH8 backpack/crud Composer Medium Fix reported
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignmentCVE-2026-54175 · GHSA-XPV2-HRFC-HW62 backpack/crud Composer High Fix reported
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelationCVE-2026-57570 · GHSA-42VX-43VC-X6PR backpack/crud Composer Medium Fix reported
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)CVE-2026-54180 · GHSA-VGMV-8XJC-6RCH backpack/crud Composer High Fix reported
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public diskCVE-2026-54179 · GHSA-8HW4-7QJR-3WXG backpack/crud Composer Medium Fix reported
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)CVE-2026-54182 · GHSA-MRC5-3MM3-45C5 backpack/crud Composer High Fix reported
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserverCVE-2026-54177 · GHSA-8Q2W-PV9P-MJVC backpack/crud Composer Medium Fix reported
Backpack\CRUD for Laravel XSS VulnerabilityCVE-2018-20962 · GHSA-6GFM-GPR3-8WH9 backpack/crud Composer Medium Fix reported