What’s Vulnerable › Products
Laravel-Backpack CRUD vulnerabilities
10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.
Check whether your Laravel-Backpack CRUD version is affected
Latest Laravel-Backpack CRUD vulnerabilities
- CVE-2026-57570 — backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation (CVSS 6.5)
- CVE-2026-54182 — backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) (CVSS 8.1)
- CVE-2026-54181 — backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted (CVSS 5.4)
- CVE-2026-54180 — backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) (CVSS 7.6)
- CVE-2026-54178 — backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk (CVSS 8.1)
- CVE-2026-54177 — backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver (CVSS 6.6)
- CVE-2026-54176 — backpack/crud: MyAccountController allows changing the login email without a current-password check (CVSS 6.5)
- CVE-2026-54175 — backpack/crud: Unverified password change in MyAccountController via mass assignment (CVSS 7.6)
- CVE-2026-54179 — backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk (CVSS 4.4)
- CVE-2022-31114 — backpack/crud Vulnerable to Cross-site Scripting (CVSS 5.1)