Medium
CVE-2026-57570
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 11
Reset filters
High
CVE-2026-54182
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
Medium
CVE-2026-54181
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
High
CVE-2026-54180
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Medium
CVE-2026-54179
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
High
CVE-2026-54178
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
Medium
CVE-2026-54177
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Medium
CVE-2026-54176
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
High
CVE-2026-54175
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
Medium
CVE-2022-31114
backpack/crud is vulnerable to Cross-Site Scripting (XSS)
Medium
CVE-2018-20962
Backpack\CRUD for Laravel XSS Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.