LA
Vendor
Laravel-Backpack
12
CVEs
0
On KEV
0
New 30D
Products
CR8.1
CRUD
Laravel-Backpack
10 CVEs0 on KEV0 new
FM9.8
File Manager
Laravel-backpack
1 CVEs0 on KEV0 new
FI9.8
FileManager
Laravel-Backpack
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54181 | CR CRUD Laravel-Backpack | 5.4 | Sep 14 | backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted |
| CVE-2026-54177 | CR CRUD Laravel-Backpack | 6.6 | Sep 14 | backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver |
| CVE-2026-54176 | CR CRUD Laravel-Backpack | 6.5 | Sep 14 | backpack/crud: MyAccountController allows changing the login email without a current-password check |
| CVE-2026-54180 | CR CRUD Laravel-Backpack | 7.6 | Sep 14 | backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) |
| CVE-2026-57570 | CR CRUD Laravel-Backpack | 6.5 | Sep 14 | backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation |
| CVE-2026-54178 | CR CRUD Laravel-Backpack | 8.1 | Sep 14 | backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk |
| CVE-2026-54182 | CR CRUD Laravel-Backpack | 8.1 | Sep 14 | backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) |
| CVE-2026-54175 | CR CRUD Laravel-Backpack | 7.6 | Sep 14 | backpack/crud: Unverified password change in MyAccountController via mass assignment |
| CVE-2026-54179 | CR CRUD Laravel-Backpack | 4.4 | Aug 31 | backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk |
| CVE-2022-31114 | CR CRUD Laravel-Backpack | 5.1 | Jun 3 | backpack/crud Vulnerable to Cross-site Scripting |
| CVE-2024-52306 | FI FileManager Laravel-Backpack | 9.8 | Nov 13 | FileManager Deserialization of Untrusted Data |