Skip to content
Laravel-backpack vulnerabilities
Newest
-
laravel-backpack crud
backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
CVE-2026-57570
Fix available
6.5 Medium
-
laravel-backpack crud
backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
CVE-2026-54182
Fix available
8.1 High
-
laravel-backpack crud
backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
CVE-2026-54181
Fix available
5.4 Medium
-
laravel-backpack crud
backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
CVE-2026-54180
Fix available
7.6 High
-
laravel-backpack crud
backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
CVE-2026-54179
Fix available
4.4 Medium
-
laravel-backpack crud
backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
CVE-2026-54178
Fix available
8.1 High
-
laravel-backpack crud
backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
CVE-2026-54177
Fix available
6.6 Medium
-
laravel-backpack crud
backpack/crud: MyAccountController allows changing the login email without a current-password check
CVE-2026-54176
Fix available
6.5 Medium
-
laravel-backpack crud
backpack/crud: Unverified password change in MyAccountController via mass assignment
CVE-2026-54175
Fix available
7.6 High
-
laravel-backpack crud
backpack/crud Vulnerable to Cross-site Scripting
CVE-2022-31114
Fix available
5.1 Medium
-
backpackforlaravel filemanager, laravel-backpack file manager +1 more
FileManager Deserialization of Untrusted Data
CVE-2024-52306
Fix available
7.7 High