GHSA-mrc5-3mm3-45c5: Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Laravel Backpack CRUD contains a command injection vulnerability in the `makeCurlRequest` function, which builds shell commands using the unescaped HTTP Host header (the name of the server being requested) and executes them with the `exec()` function. An attacker without authentication can craft a malicious Host header to break out of the command and run arbitrary OS commands on the server.