PT-2026-80294

Summary BackpackCRUDStats::makeCurlRequest builds a shell command using unescaped input that originates from the HTTP Host header, then passes it to exec. A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary OS commands as the web user. The...

PT-2019-10398

Name of the Vulnerable Software and Affected Versions BackpackCRUD Backpack component versions prior to 3.4.9 Description The issue allows for XSS via the select field type. Recommendations For versions prior to 3.4.9, update to version 3.4.9 or later to resolve the issue...