[HIGH] Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

PKSA-x88v-wcq5-j3kt CVE-2026-54175 GHSA-xpv2-hrfc-hw62

Affected version: >=7.0.0-alpha.1,<7.0.34|<6.8.11

Reported by:
GitHub

[MEDIUM] backpack/crud is vulnerable to Cross-Site Scripting (XSS)

PKSA-8yrj-8khf-srxh CVE-2022-31114 GHSA-m8xx-3x29-84h8

Affected version: <4.0.63|>=4.1.0,<4.1.69|>=5.0.0,<5.0.13

Reported by:
GitHub

[MEDIUM] Backpack\CRUD for Laravel XSS Vulnerability

PKSA-cc3w-dbyz-xzgh CVE-2018-20962 GHSA-6gfm-gpr3-8wh9

Affected version: <3.4.9

Reported by:
GitHub