Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CRUD — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in CRUD, with AI-generated Chinese analysis, references, and POCs.

Vendor: Laravel-Backpack

CVE ID Title CVSS Severity Published
CVE-2026-54181 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted CWE-79 5.4 Medium 2026-09-14
CVE-2026-54177 backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver CWE-434 6.6 Medium 2026-09-14
CVE-2026-54176 backpack/crud: MyAccountController allows changing the login email without a current-password check CWE-287 6.5 Medium 2026-09-14
CVE-2026-54180 backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) CWE-639 7.6 High 2026-09-14
CVE-2026-57570 backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation CWE-862 6.5 Medium 2026-09-14
CVE-2026-54178 backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk CWE-22 8.1 High 2026-09-14
CVE-2026-54182 backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) CWE-20 8.1 High 2026-09-14
CVE-2026-54175 backpack/crud: Unverified password change in MyAccountController via mass assignment CWE-620 7.6 High 2026-09-14
CVE-2026-54179 backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk CWE-79 4.4 Medium 2026-08-31
CVE-2022-31114 backpack/crud Vulnerable to Cross-site Scripting CWE-79 - - 2026-06-03

All 10 known CVE vulnerabilities affecting CRUD with full Chinese analysis, references, and POCs where available.