CRUD vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

CR

Product

CRUD

by Laravel-Backpack · last CVE Sep 14, 2026

10

CVEs

0

On KEV

8.1

Max CVSS

0

New 30D

Vulnerabilities10 In the news0 Timeline

Severity mix

Critical 0High 4Medium 6Low 0

Severity

All severities10 Critical0 High4 Medium6 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add CRUD to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-54178	8.1	1%	Sep 14	backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk Affected: >= 5.0.0, < 6.0.0; >= 6.0.0, < 6.8.12; >= 7.0.0, < 7.0.35
CVE-2026-54182	8.1	1%	Sep 14	backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) Affected: < 4.1.70; >= 5.0.0, < 5.6.2; >= 6.0.0, < 6.8.13; >= 7.0.0, < 7.0.36
CVE-2026-54180	7.6	0%	Sep 14	backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38
CVE-2026-54175	7.6	1%	Sep 14	backpack/crud: Unverified password change in MyAccountController via mass assignment Affected: < 6.8.11; >= 7.0.0, < 7.0.34
CVE-2026-54177	6.6	1%	Sep 14	backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38
CVE-2026-54176	6.5	1%	Sep 14	backpack/crud: MyAccountController allows changing the login email without a current-password check Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38
CVE-2026-57570	6.5	0%	Sep 14	backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation Affected: >= 6.0.0, < 6.8.15; >= 7.0.0, < 7.0.47
CVE-2026-54181	5.4	0%	Sep 14	backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38
CVE-2022-31114	5.1	0%	Jun 3	backpack/crud Vulnerable to Cross-site Scripting Affected: >= 5.0.0, < 5.0.13; >= 4.0.0, < 4.1.69; < 4.0.63
CVE-2026-54179	4.4	0%	Aug 31	backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38