CVE-2018-20962: Backpackforlaravel Backpack\crud

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.

Affected products

• Backpackforlaravel Backpack\crud: before 3.4.9 (fixed in 3.4.9)

Published 2019-08-08. Last modified 2026-06-17.