Skip to content
OpenAdvisories

Package · Packagist

backpack/crud

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-54181

    backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

    backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inver…

    Laravel-Backpack CRUD backpack/crud Packagist
  • Medium 6.6
    CVE-2026-54177

    backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

    backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, HasUploadFields methods uploadFileToDisk and uploadMul…

    Laravel-Backpack CRUD backpack/crud Packagist
  • Medium 6.5
    CVE-2026-54176

    backpack/crud: MyAccountController allows changing the login email without a current-password check

    backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admi…

    Laravel-Backpack CRUD backpack/crud Packagist
  • Medium 6.5
    CVE-2026-57570

    backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

    backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelat…

    Laravel-Backpack CRUD backpack/crud Packagist
  • Medium 4.4
    CVE-2026-54179

    backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

    backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php me…

    Laravel-Backpack CRUD backpack/crud Packagist
  • Medium 5.1
    CVE-2022-31114

    backpack/crud Vulnerable to Cross-site Scripting

    backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An at…

    Laravel-Backpack CRUD backpack/crud Packagist
  • Medium 6.1
    CVE-2018-20962

    Backpack\CRUD for Laravel XSS Vulnerability

    The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.

    backpack/crud Packagist