GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
5 advisories
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
High
CVE-2026-54175
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Moderate
CVE-2026-54177
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
High
CVE-2026-54178
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
Moderate
CVE-2026-54181
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
High
CVE-2026-54182
was published
for
backpack/crud
(Composer)
Aug 20, 2026
ProTip!
Advisories are also available from the
GraphQL API