L
Vendor security profile
Laravel-Backpack
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical0
CISA KEV0
Public exploit0
Patch rate%100
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
1
8
0
CVE KEV
CVE severity distribution
9toplam CVE
High4 (44%)
Medium5 (56%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%0
Public exploit
9Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
5.4
CVE-2026-54181
backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
L
Patch verifiedEPSS %0
6.6
CVE-2026-54177
backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
L
Patch verifiedEPSS %1
6.5
CVE-2026-54176
backpack/crud: MyAccountController allows changing the login email without a current-password check
L
Patch verifiedEPSS %1
7.6
CVE-2026-54180
backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
L
Patch verifiedEPSS %0
6.5
CVE-2026-57570
backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
L
Patch verifiedEPSS %0
8.1
CVE-2026-54178
backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
L
Patch verifiedEPSS %1
8.1
CVE-2026-54182
backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
L
Patch verifiedEPSS %1
7.6
CVE-2026-54175
backpack/crud: Unverified password change in MyAccountController via mass assignment
L
Patch verifiedEPSS %1
4.4
CVE-2026-54179
backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
L
Patch verifiedEPSS %0