Login Request a demo
CR
Product
CRUD
by Laravel-Backpack · last CVE Sep 14, 2026
10
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 0High 4Medium 6Low 0
Severity
All severities10Critical0High4Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add CRUD to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-54177
6.6
1%
Sep 14
backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38
CVE-2026-54176
6.5
1%
Sep 14
backpack/crud: MyAccountController allows changing the login email without a current-password check
Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38
CVE-2026-57570
6.5
0%
Sep 14
backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
Affected: >= 6.0.0, < 6.8.15; >= 7.0.0, < 7.0.47
CVE-2026-54181
5.4
0%
Sep 14
backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38
CVE-2022-31114
5.1
0%
Jun 3
backpack/crud Vulnerable to Cross-site Scripting
Affected: >= 5.0.0, < 5.0.13; >= 4.0.0, < 4.1.69; < 4.0.63
CVE-2026-54179
4.4
0%
Aug 31
backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Affected: >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38
Showing 6