CVE-2018-20962

MEDIUM

Backpack\CRUD < 3.4.9 - Cross-Site Scripting via Select Field Type

Title source: llm
STIX 2.1

Description

The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.

References (4)

Core 4
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/Laravel-Backpack/CRUD/compare/3.4.8...3.4.9
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/Laravel-Backpack/CRUD/issues/1297
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/Laravel-Backpack/CRUD/blob/master/CHANGELOG.md

Scores

CVSS v3 6.1
EPSS 0.0131
EPSS Percentile 67.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
backpack/crud 0 - 3.4.9Packagist
backpackforlaravel/backpack\\crud < 3.4.9
Published Aug 08, 2019
Tracked Since Feb 18, 2026