GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
7 advisories
backpack/crud is vulnerable to Cross-Site Scripting (XSS)
Moderate
CVE-2022-31114
was published
for
backpack/crud
(Composer)
Jun 3, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
Moderate
CVE-2026-54176
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Moderate
CVE-2026-54177
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
High
CVE-2026-54178
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Moderate
CVE-2026-54179
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
High
CVE-2026-54182
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
Moderate
CVE-2026-57570
was published
for
backpack/crud
(Composer)
Aug 20, 2026
ProTip!
Advisories are also available from the
GraphQL API