The Backpack\CRUD Backpack component prior to 3.4.9 for Laravel allows XSS via the select field type.
backpackforlaravel backpack\\\\crud