Backpack for Laravel

An unauthenticated command injection vulnerability in Laravel Backpack's Stats::makeCurlRequest method allows remote code execution by exploiting unsanitized Host header input passed to an exec() shell command.