Vulnerabilities in Laravel-Backpack
11 resultsCVE-2026-54177MEDIUMbackpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserverEPSS 0.9%CVE-2026-54182HIGHbackpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)EPSS 0.8%CVE-2026-54176MEDIUMbackpack/crud: MyAccountController allows changing the login email without a current-password checkEPSS 0.7%CVE-2024-52306HIGHFileManager Deserialization of Untrusted DataEPSS 0.6%CVE-2026-54178HIGHbackpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDiskEPSS 0.6%CVE-2026-54175HIGHbackpack/crud: Unverified password change in MyAccountController via mass assignmentEPSS 0.6%CVE-2026-54180HIGHbackpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)EPSS 0.5%CVE-2026-57570MEDIUMbackpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelationEPSS 0.4%CVE-2026-54181MEDIUMbackpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are invertedEPSS 0.3%CVE-2022-31114MEDIUMbackpack/crud Vulnerable to Cross-site ScriptingEPSS 0.3%CVE-2026-54179MEDIUMbackpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public diskEPSS 0.3%